Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Проблем с Лаптоп / Уин7.Процесора работи на 100% от самото му пускане [решен]

stimulate
в Премахване на зловреден софтуер

Featured Replies

Резултатите от dds.scr

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Ў­б at 23:53:52,60 on зҐвў 05.05.2011 Ј.

Internet Explorer: 8.0.7600.16385

Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1026.18.1014.95 [GMT 3:00]

.

AV: AVG Internet Security 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Internet Security 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}

.

============== Running Processes ===============

.

C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\AVG\AVG10\avgtray.exe

C:\Program Files\AVG\AVG10\avgfws.exe

C:\Program Files\AVG\AVG10\avgwdsvc.exe

C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\AVG\AVG10\avgam.exe

C:\Program Files\AVG\AVG10\avgnsx.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\AVG\AVG10\avgcsrvx.exe

C:\Program Files\Garena\Garena.exe

C:\PROGRA~1\AVG\AVG10\avgrsx.exe

C:\Program Files\AVG\AVG10\avgcsrvx.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\AVG\AVG10\avgmfapx.exe

C:\Users\бнс\Desktop\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://fullarticles.net

uInternet Settings,ProxyServer = http=127.0.0.1:51636

uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll

mWinlogon: Taskman=c:\recycler\s-1-5-21-0243556031-888888379-781863308-2734\ju7bd.exe

uWinlogon: Shell=explorer.exe,c:\users\бнс\appdata\roaming\dwm.exe

uWindows: Load=c:\users\9974~1\appdata\local\temp\csrss.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office14\GROOVEEX.DLL

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL

BHO: CrowdStar Gamebar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: : {d4cf558b-745c-44ff-854f-d6fcae69b6e1} - c:\progra~1\931DA.dll

TB: CrowdStar Gamebar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun

uRun: [DriverLoader] c:\users\бнс\appdata\roaming\507832571.exe

uRun: [engel] c:\users\бнс\appdata\roaming\updates\updates.exe

uRun: [Google Update] "c:\users\бнс\appdata\local\google\update\GoogleUpdate.exe" /c

mRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices

mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe

mRun: [indexSearch] c:\program files\scansoft\paperport\IndexSearch.exe

mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming

mRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [NVIDIA driver monitor] c:\windows\nvsvc32.exe

mRun: [system] c:\users\бнс\appdata\roaming\As9qipaJ1.exe

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

mRun: [Win7Service] c:\users\р±рѕсѓ\appdata\roaming\mirc\DriverUpdate.exe

mRun: [wuaplo] c:\users\бнс\appdata\roaming\wusolsl.exe

mRun: [Local] c:\users\бнс\appdata\roaming\local.exe

mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe

mRun: [conhost] c:\users\бнс\appdata\roaming\microsoft\conhost.exe

mExplorerRun: [wuaplo] c:\users\бнс\appdata\roaming\wusolsl.exe

mExplorerRun: [Local] c:\users\бнс\appdata\roaming\local.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office14\GROOVEEX.DLL

mASetup: {98BB6A2D-FACA-FECF-AA1C-95A9BCFCBDDA} - c:\users\Сашо\appdata\roaming\wusolsl.exe

mASetup: {DA59C2AE-F5AF-AA1F-AA3B-398FC0BAE8F2} - c:\users\Сашо\appdata\roaming\local.exe

uASetup: {98BB6A2D-FACA-FECF-AA1C-95A9BCFCBDDA} - c:\users\Сашо\appdata\roaming\wusolsl.exe

uASetup: {DA59C2AE-F5AF-AA1F-AA3B-398FC0BAE8F2} - c:\users\Сашо\appdata\roaming\local.exe

.

============= SERVICES / DRIVERS ===============

.

R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86

R? McComponentHostService;McAfee Security Scan Component Host Service

R? Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service

R? ndisrd;WinpkFilter Service

R? srenum;srenum

R? svcoolk;svcoolk

R? SwitchBoard;SwitchBoard

R? WatAdminSvc;“б«гЈ  ­  вҐе­®«®ЈЁЁвҐ §   ЄвЁўЁа ­Ґ ­  Windows

S? Avgfwfd;AVG network filter service

S? avgfws;AVG Firewall

S? AVGIDSAgent;AVGIDSAgent

S? AVGIDSDriver;AVGIDSDriver

S? AVGIDSEH;AVGIDSEH

S? AVGIDSFilter;AVGIDSFilter

S? AVGIDSShim;AVGIDSShim

S? Avgldx86;AVG AVI Loader Driver

S? Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield

S? Avgrkx86;AVG Anti-Rootkit Driver

S? Avgtdix;AVG TDI Driver

S? avgwd;AVG WatchDog

S? b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0

S? GGSAFERDriver;GGSAFER Driver

S? osppsvc;Office Software Protection Platform

S? vwififlt;Virtual WiFi Filter Driver

S? vwifimp;Microsoft Virtual WiFi Miniport Service

.

=============== Created Last 30 ================

.

2011-05-02 19:58:15 79872 ---ha-w- c:\users\9974~1\appdata\roaming\install.48918.exe

2011-05-02 19:37:51 0 ---ha-w- c:\users\9974~1\appdata\roaming\gbot.exe

2011-05-02 19:36:21 0 ---ha-w- c:\users\9974~1\appdata\roaming\your_exe(2).exe

2011-05-02 19:28:11 0 ---ha-w- c:\users\9974~1\appdata\roaming\thebot.exe

2011-05-01 20:41:30 147374 ---ha-w- c:\users\9974~1\appdata\roaming\fud.exe

2011-04-30 20:19:35 139 ----a-w- c:\users\9974~1\appdata\roaming\microsoft\gb_96689.bat

2011-04-29 17:55:40 181760 ------w- c:\users\9974~1\appdata\roaming\dwmu.exe

2011-04-29 17:55:06 151 ----a-w- c:\users\9974~1\appdata\roaming\microsoft\gb_76087334.bat

2011-04-28 09:57:14 -------- d--h--w- C:\$AVG

2011-04-27 23:46:03 -------- d-----w- c:\users\9974~1\appdata\roaming\AVG10

2011-04-27 23:45:26 -------- d--h--w- c:\progra~2\Common Files

2011-04-27 23:41:41 -------- d-----w- c:\windows\system32\drivers\AVG

2011-04-27 23:41:41 -------- d-----w- c:\progra~2\AVG10

2011-04-27 23:40:51 -------- d-----w- c:\program files\AVG

2011-04-27 23:37:02 -------- d-----w- c:\progra~2\MFAData

2011-04-27 22:59:38 -------- d-----w- c:\users\9974~1\appdata\roaming\updates

2011-04-27 21:36:21 0 ----a-w- c:\windows\system32\b33.exe

2011-04-27 20:29:05 0 ----a-w- c:\windows\ddx.exe

2011-04-27 20:29:03 0 ----a-w- c:\windows\9.exe

2011-04-27 20:26:17 58976 ----a-w- c:\windows\system32\drivers\srenum.sys

2011-04-27 20:26:17 4128 ----a-w- c:\windows\system32\msrun.exe

2011-04-27 20:24:02 179200 ----a-w- c:\users\9974~1\appdata\roaming\dwm.exe

2011-04-27 20:23:49 192512 --sh--r- c:\users\9974~1\appdata\roaming\507832571.exe

2011-04-25 19:57:33 1305170 ---ha-w- c:\users\9974~1\appdata\roaming\o.exe

2011-04-25 19:43:07 1305170 ---ha-w- c:\users\9974~1\appdata\roaming\25-Apr-11-427166d40c29819-o.exe

2011-04-25 19:18:07 -------- d-----w- c:\users\9974~1\appdata\local\Google

2011-04-24 20:36:06 1299580 ---ha-w- c:\users\9974~1\appdata\roaming\I.exe

2011-04-24 18:59:37 -------- d-----w- c:\users\9974~1\appdata\roaming\mIRC

2011-04-23 19:06:39 200704 ------w- c:\users\9974~1\appdata\roaming\audiohd.exe

2011-04-23 19:05:54 200704 ---ha-w- c:\users\9974~1\appdata\roaming\bt.exe

2011-04-23 19:03:34 16384 ----a-w- c:\users\9974~1\appdata\roaming\svchost.exe

2011-04-23 19:03:22 532480 ------w- c:\users\9974~1\appdata\roaming\winserver.exe

2011-04-22 20:15:13 445952 ----a-w- c:\program files\931DA.dll

2011-04-22 20:04:34 -------- d-----w- c:\users\9974~1\appdata\roaming\Darer

2011-04-22 20:03:07 -------- d-----w- c:\program files\Darer

2011-04-15 18:01:42 -------- d-----w- c:\users\9974~1\appdata\local\Apps

2011-04-15 18:01:41 -------- d-----w- c:\users\9974~1\appdata\local\Deployment

.

==================== Find3M ====================

.

2011-02-19 05:33:11 802304 ----a-w- c:\windows\system32\FntCache.dll

2011-02-19 05:32:48 1074176 ----a-w- c:\windows\system32\DWrite.dll

2011-02-19 05:32:35 739840 ----a-w- c:\windows\system32\d2d1.dll

2011-02-16 15:16:12 2829 ----a-w- c:\windows\War3Unin.pif

2011-02-16 15:16:12 139264 ----a-w- c:\windows\War3Unin.exe

.

============= FINISH: 0:01:34,60 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_11-03-05.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 25.2.2010 г. 22:28:08

System Uptime: 5.5.2011 г. 21:52:03 (3 hours ago)

.

Motherboard: Acer | | Acadia

Processor: Intel® Celeron® CPU 560 @ 2.13GHz | uPGA-478 | 2128/133mhz

.

==== Disk Partitions =========================

.

.

==== Installed Programs ======================

.

µTorrent

7-Zip 9.20

Adobe AIR

Adobe Community Help

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Media Player

Adobe Photoshop CS5

Adobe Reader X (10.0.1)

Ask Toolbar

AVG 2011

Brother DCP-7010

Diablo II - Eastern Sun 3.00 Full

eReg

Garena 2010

Google Chrome

Logitech SetPoint 6.0

McAfee Security Scan Plus

Microsoft .NET Framework 4 Client Profile

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Word MUI (English) 2010

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

One

PaperPort

PDF Settings CS5

Skype Toolbars

Skype™ 4.2

StoreHouse LITE 2.0.2-16

VLC media player 1.0.5

Warcraft III

Warcraft III: All Products

Winamp

Winamp Detector Plug-in

Windows Media Player Firefox Plugin

.

==== End Of File ===========================

Резултати и от SecurityCheck

Results of screen317's Security Check version 0.99.10

Windows 7 (UAC is disabled!)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

AVG 2011

McAfee Security Scan Plus

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Adobe Flash Player 10.0.45.2

Adobe Reader X (10.0.1)

````````````````````````````````

Process Check:

objlist.exe by Laurent

AVG avgwdsvc.exe

AVG avgtray.exe

AVG avgrsx.exe

AVG avgnsx.exe

AVG avgemc.exe

``````````End of Log````````````

Надявам се да има решение на проблема за да не се налага да преинсталирам уина.

Поздрави!

Редактирано от nologo (преглед на промените)

Деинсталирайте AVG 2011 от контролния панел, ето как става: справка.

След това пуснете отново лог от SecurityCheck.

Предполагам, че проблемите са доста сериозни, като гледам лога на DDS. Ето част от тези проблеми:

uInternet Settings,ProxyServer = http=127.0.0.1:51636

Ще може ли да проверите на virustotal.com следните файлове:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\conhost.exe

След като излязат резултатите, пуснете линк, за да ги видим.

  • Автор

Results of screen317's Security Check version 0.99.10

Windows 7 (UAC is disabled!)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

McAfee Security Scan Plus

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Adobe Flash Player 10.0.45.2

Adobe Reader X (10.0.1)

````````````````````````````````

Process Check:

objlist.exe by Laurent

``````````End of Log````````````

Незнам точно как се работи с този сайт но ето това е резултата.

MD5: 505bf4d1cadeb8d4f8bcd08d944de25d

Date first seen: 2009-07-17 15:52:25 (UTC)

Date last seen: 2011-05-03 16:37:47 (UTC)

Detection ratio: 0/42

MD5: 29d9fcdf65b7c823688a035937bb6697

Date first seen: 2009-07-17 15:51:24 (UTC)

Date last seen: 2011-05-03 16:39:03 (UTC)

Detection ratio: 0/41

    •
    • Харесване 1

    Следвайте инструкцията за работа с OTL:

    • Изтеглете OTL.exe и го запазете на десктопа.
    • Стартирайте файла Публикувано изображение с двукратен клик на мишката.
    • Направете следните настройки:
    Публикувано изображение

    • Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):
    netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
    • Натиснете маркираният в синьо бутон: Публикувано изображение.
    • Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).
    •
    • Харесване 1
    • Автор

    OTL

    OTL logfile created on: 6.5.2011 г. 14:25:50 - Run 1

    OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\бнс\Desktop

    Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

    Internet Explorer (Version = 8.0.7600.16385)

    Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'

    1 014,00 Mb Total Physical Memory | 561,00 Mb Available Physical Memory | 55,00% Memory free

    2,00 Gb Paging File | 1,00 Gb Available in Paging File | 67,00% Paging File free

    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

    Drive C: | 50,68 Gb Total Space | 33,46 Gb Free Space | 66,02% Space Free | Partition Type: NTFS

    Drive D: | 61,01 Gb Total Space | 47,69 Gb Free Space | 78,17% Space Free | Partition Type: NTFS

    Computer Name: БНС-PC | User Name: бнс | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users

    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Users\бнс\Desktop\OTL.exe (OldTimer Tools)

    PRC - C:\Users\бнс\AppData\Roaming\507832571.exe (Larssss)

    PRC - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)

    PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)

    PRC - C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE (Logitech, Inc.)

    PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

    PRC - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

    PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)

    PRC - C:\Windows\explorer.exe (Microsoft Corporation)

    PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

    PRC - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

    ========== Modules (SafeList) ==========

    MOD - C:\Users\бнс\Desktop\OTL.exe (OldTimer Tools)

    MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

    ========== Win32 Services (SafeList) ==========

    SRV - (svcoolk) -- File not found

    SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)

    SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

    SRV - (LBTServ) -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe (Logitech, Inc.)

    SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)

    SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)

    SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

    SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

    SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

    ========== Driver Services (SafeList) ==========

    DRV - (srenum) -- C:\Windows\System32\drivers\srenum.sys ()

    DRV - (dtscsi) -- C:\Windows\System32\Drivers\dtscsi.sys (DT Soft Ltd.)

    DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()

    DRV - (vpcvmm) -- C:\Windows\System32\drivers\vpcvmm.sys (Microsoft Corporation)

    DRV - (vpcbus) -- C:\Windows\System32\drivers\vpchbus.sys (Microsoft Corporation)

    DRV - (vpcusb) -- C:\Windows\System32\drivers\vpcusb.sys (Microsoft Corporation)

    DRV - (vpcnfltr) -- C:\Windows\System32\drivers\vpcnfltr.sys (Microsoft Corporation)

    DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)

    DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)

    DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)

    DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)

    DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)

    DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)

    DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)

    DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)

    DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)

    DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)

    DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

    ========== Standard Registry (SafeList) ==========

    ========== Internet Explorer ==========

    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fullarticles.net

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = bg

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AE A2 34 6F B4 B7 CA 01 [binary data]

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:51636

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultengine: "Ask.com"

    FF - prefs.js..browser.search.defaultenginename: "Ask.com"

    FF - prefs.js..browser.search.order.1: "Ask.com"

    FF - prefs.js..browser.search.selectedEngine: "Ask.com"

    FF - prefs.js..browser.search.useDBForOrder: true

    FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198

    FF - prefs.js..extensions.enabledItems: [email protected]:3.11.3.15590

    FF - prefs.js..extensions.enabledItems: {6b35a719-2cbb-4834-8538-7ac1d19a9664}:1.0.0

    FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=CDS&o=16205&locale=en_US&apn_uid=B3B0287F-6821-4F0B-9372-1BEFBF88607D&apn_ptnrs=QR&apn_sauid=3378F2F6-DA93-41A9-95C2-76261C47FD13&apn_dtid=&q="

    FF - prefs.js..network.proxy.http: "127.0.0.1"

    FF - prefs.js..network.proxy.http_port: 51636

    FF - prefs.js..network.proxy.type: 1

    [2010.02.27 16:58:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\бнс\AppData\Roaming\mozilla\Extensions

    [2011.04.25 20:21:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions

    [2011.03.21 13:05:23 | 000,000,000 | ---D | M] (CrowdStar Gamebar) -- C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]

    [2011.04.25 22:13:42 | 000,002,385 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\Mozilla\Firefox\Profiles\x25f4lpk.default\searchplugins\askcom.xml

    [2011.04.25 22:16:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

    [2011.04.22 23:15:13 | 000,000,000 | ---D | M] () -- C:\Program Files\mozilla firefox\extensions\{6b35a719-2cbb-4834-8538-7ac1d19a9664}

    [2010.02.27 17:43:34 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

    File not found (No name found) -- C:\USERS\Р±РЅСЃ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\X25F4LPK.DEFAULT\EXTENSIONS\[email protected]

    O1 HOSTS File: ([2009.06.11 00:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

    O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

    O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

    O2 - BHO: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

    O2 - BHO: () - {D4CF558B-745C-44FF-854F-D6FCAE69B6E1} - C:\PROGRA~1\931DA.dll (Extension)

    O3 - HKLM\..\Toolbar: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

    O3 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\..\Toolbar\WebBrowser: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

    O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

    O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

    O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)

    O4 - HKLM..\Run: [bCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

    O4 - HKLM..\Run: [conhost] File not found

    O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)

    O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

    O4 - HKLM..\Run: [Local] File not found

    O4 - HKLM..\Run: [NVIDIA driver monitor] File not found

    O4 - HKLM..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

    O4 - HKLM..\Run: [system] File not found

    O4 - HKLM..\Run: [Win7Service] File not found

    O4 - HKLM..\Run: [wuaplo] File not found

    O4 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

    O4 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000..\Run: [DriverLoader] C:\Users\бнс\AppData\Roaming\507832571.exe (Larssss)

    O4 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000..\Run: [engel] C:\Users\бнс\AppData\Roaming\updates\updates.exe ()

    O4 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)

    O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

    O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

    O4 - Startup: C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe ()

    O4 - Startup: C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: wuaplo = C:\Users\бнс\AppData\Roaming\wusolsl.exe

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: Local = C:\Users\бнс\AppData\Roaming\local.exe

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 ()

    O7 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

    O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

    O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

    O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

    O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

    O13 - gopher Prefix: missing

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: TaskMan - (C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-2734\ju7bd.exe) - File not found

    O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

    O20 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000 Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

    O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

    O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

    O32 - HKLM CDRom: AutoRun - 1

    O32 - AutoRun File - [2009.06.11 00:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

    O34 - HKLM BootExecute: (autocheck autochk *) - File not found

    O35 - HKLM\..comfile [open] -- "%1" %*

    O35 - HKLM\..exefile [open] -- "%1" %*

    O37 - HKLM\...com [@ = comfile] -- "%1" %*

    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: FastUserSwitchingCompatibility - File not found

    NetSvcs: Ias - File not found

    NetSvcs: Nla - File not found

    NetSvcs: Ntmssvc - File not found

    NetSvcs: NWCWorkstation - File not found

    NetSvcs: Nwsapagent - File not found

    NetSvcs: SRService - File not found

    NetSvcs: WmdmPmSp - File not found

    NetSvcs: LogonHours - File not found

    NetSvcs: PCAudit - File not found

    NetSvcs: helpsvc - File not found

    NetSvcs: uploadmgr - File not found

    Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)

    Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)

    Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)

    Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)

    Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)

    Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

    Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)

    Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)

    Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)

    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

    Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)

    Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)

    Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)

    Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)

    Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)

    Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)

    Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)

    Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)

    Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)

    Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

    ========== Files/Folders - Created Within 30 Days ==========

    [2011.05.06 00:53:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi

    [2011.05.05 23:15:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

    [2011.05.05 23:14:34 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

    [2011.05.05 22:55:56 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\бнс\Desktop\OTL.exe

    [2011.05.01 22:21:49 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

    [2011.04.28 12:57:14 | 000,000,000 | -H-D | C] -- C:\$AVG

    [2011.04.28 02:46:03 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\AVG10

    [2011.04.28 02:45:26 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

    [2011.04.28 02:41:41 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG10

    [2011.04.28 02:40:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVG

    [2011.04.28 02:37:02 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData

    [2011.04.28 02:36:54 | 005,497,592 | ---- | C] (AVG Technologies) -- C:\Users\бнс\Desktop\avg_free_stb_all_2011_1321_cnet.exe

    [2011.04.28 01:59:38 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\updates

    [2011.04.28 00:54:51 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II - Eastern Sun 3.00 Full

    [2011.04.27 23:27:41 | 000,000,000 | ---D | C] -- C:\Windows\Minidump

    [2011.04.27 23:25:19 | 000,000,000 | RHSD | C] -- C:\RECYCLER

    [2011.04.27 23:23:49 | 000,192,512 | RHS- | C] (Larssss) -- C:\Users\бнс\AppData\Roaming\507832571.exe

    [2011.04.25 22:18:07 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Local\Google

    [2011.04.24 21:59:37 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\mIRC

    [2011.04.23 22:06:39 | 000,200,704 | ---- | C] (yfrPTYRO) -- C:\Users\бнс\AppData\Roaming\audiohd.exe

    [2011.04.23 22:05:54 | 000,200,704 | -H-- | C] (yfrPTYRO) -- C:\Users\бнс\AppData\Roaming\bt.exe

    [2011.04.22 23:15:13 | 000,445,952 | ---- | C] (Extension) -- C:\Program Files\931DA.dll

    [2011.04.22 23:04:34 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Darer

    [2011.04.22 23:03:19 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Darer

    [2011.04.22 23:03:07 | 000,000,000 | ---D | C] -- C:\Program Files\Darer

    [2011.04.15 21:01:42 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Local\Apps

    [2011.04.15 21:01:41 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Local\Deployment

    ========== Files - Modified Within 30 Days ==========

    [2011.05.06 14:14:03 | 000,001,000 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4294071207-530640845-1734815284-1000UA.job

    [2011.05.06 14:10:53 | 000,017,360 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

    [2011.05.06 14:10:53 | 000,017,360 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

    [2011.05.06 14:03:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

    [2011.05.06 14:02:51 | 797,433,856 | -HS- | M] () -- C:\hiberfil.sys

    [2011.05.05 23:53:05 | 000,625,664 | ---- | M] () -- C:\Users\бнс\Desktop\dds.scr

    [2011.05.05 23:14:10 | 001,110,476 | ---- | M] () -- C:\Users\бнс\Desktop\7z920.exe

    [2011.05.05 22:54:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\бнс\Desktop\OTL.exe

    [2011.05.05 22:53:00 | 000,879,081 | ---- | M] () -- C:\Users\бнс\Desktop\SecurityCheck.exe

    [2011.05.05 22:45:07 | 000,000,948 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4294071207-530640845-1734815284-1000Core.job

    [2011.05.03 22:05:08 | 000,046,742 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\room.dat

    [2011.05.02 22:58:22 | 000,079,872 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\install.48918.exe

    [2011.05.02 22:37:51 | 000,000,000 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\gbot.exe

    [2011.05.02 22:36:21 | 000,000,000 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\your_exe(2).exe

    [2011.05.02 22:28:11 | 000,000,000 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\thebot.exe

    [2011.05.02 20:31:47 | 000,008,700 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\881E.EC9

    [2011.05.01 23:44:03 | 196,386,294 | ---- | M] () -- C:\Windows\MEMORY.DMP

    [2011.05.01 23:41:33 | 000,147,374 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\fud.exe

    [2011.05.01 23:31:58 | 000,028,294 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\data.dat

    [2011.05.01 22:21:54 | 000,002,264 | ---- | M] () -- C:\Users\бнс\Desktop\Google Chrome.lnk

    [2011.04.28 02:36:56 | 005,497,592 | ---- | M] (AVG Technologies) -- C:\Users\бнс\Desktop\avg_free_stb_all_2011_1321_cnet.exe

    [2011.04.28 01:59:30 | 000,000,000 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe

    [2011.04.28 01:59:30 | 000,000,000 | ---- | M] () -- C:\Windows\System32\b33.exe

    [2011.04.27 23:29:05 | 000,000,000 | ---- | M] () -- C:\Windows\ddx.exe

    [2011.04.27 23:29:03 | 000,000,000 | ---- | M] () -- C:\Windows\9.exe

    [2011.04.27 23:26:17 | 000,058,976 | ---- | M] () -- C:\Windows\System32\drivers\srenum.sys

    [2011.04.27 23:26:17 | 000,004,128 | ---- | M] () -- C:\Windows\System32\msrun.exe

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

    [2011.04.27 23:26:03 | 000,000,017 | ---- | M] () -- C:\Windows\keys.ini

    [2011.04.27 23:24:03 | 000,181,760 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\dwmu.exe

    [2011.04.27 23:23:44 | 000,192,512 | RHS- | M] (Larssss) -- C:\Users\бнс\AppData\Roaming\507832571.exe

    [2011.04.27 16:37:12 | 000,616,546 | ---- | M] () -- C:\Windows\System32\perfh009.dat

    [2011.04.27 16:37:12 | 000,106,926 | ---- | M] () -- C:\Windows\System32\perfc009.dat

    [2011.04.25 23:05:21 | 001,305,170 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\o.exe

    [2011.04.25 22:43:10 | 001,305,170 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\25-Apr-11-427166d40c29819-o.exe

    [2011.04.25 22:27:03 | 000,061,440 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\chrtmp

    [2011.04.24 23:36:18 | 001,299,580 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\I.exe

    [2011.04.24 21:46:41 | 000,016,384 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\svchost.exe

    [2011.04.23 22:21:40 | 000,147,456 | ---- | M] () -- C:\Windows\System32\__rzi_00.827

    [2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_01.605

    [2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_01.073

    [2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_01.067

    [2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_00.870

    [2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_00.198

    [2011.04.23 22:21:40 | 000,032,768 | ---- | M] () -- C:\Windows\System32\__rzi_00.824

    [2011.04.23 22:20:39 | 003,092,480 | ---- | M] () -- C:\Windows\System32\__rzi_15.653

    [2011.04.23 22:18:33 | 030,502,912 | ---- | M] () -- C:\Windows\System32\__rzi_00.985

    [2011.04.23 22:18:23 | 027,553,792 | ---- | M] () -- C:\Windows\System32\__rzi_01.706

    [2011.04.23 22:18:19 | 035,872,768 | ---- | M] () -- C:\Windows\System32\__rzi_01.264

    [2011.04.23 22:18:18 | 028,033,024 | ---- | M] () -- C:\Windows\System32\__rzi_02.356

    [2011.04.23 22:18:16 | 036,331,520 | ---- | M] () -- C:\Windows\System32\__rzi_00.878

    [2011.04.23 22:18:15 | 041,709,568 | ---- | M] () -- C:\Windows\System32\__rzi_00.038

    [2011.04.23 22:17:13 | 014,291,787 | ---- | M] () -- C:\Users\бнс\Desktop\Снимки.rar

    [2011.04.23 22:14:01 | 000,196,608 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.336

    [2011.04.23 22:13:59 | 000,888,832 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.956

    [2011.04.23 22:13:59 | 000,705,511 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rar_00.584

    [2011.04.23 22:13:58 | 013,902,940 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.161

    [2011.04.23 22:13:53 | 002,174,976 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.959

    [2011.04.23 22:13:37 | 003,517,044 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rar_00.944

    [2011.04.23 22:12:57 | 004,673,536 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_04.280

    [2011.04.23 22:12:53 | 011,685,888 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.515

    [2011.04.23 22:12:50 | 007,393,280 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.170

    [2011.04.23 22:12:47 | 013,746,176 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.623

    [2011.04.23 22:12:47 | 013,025,280 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.821

    [2011.04.23 22:12:47 | 012,304,384 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.654

    [2011.04.23 22:12:44 | 013,348,864 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.089

    [2011.04.23 22:12:42 | 009,576,448 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.354

    [2011.04.23 22:12:34 | 012,976,128 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.099

    [2011.04.23 22:12:33 | 011,993,088 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.110

    [2011.04.23 22:12:25 | 015,749,120 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.744

    [2011.04.23 22:12:25 | 013,811,712 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.734

    [2011.04.23 22:12:21 | 017,207,296 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.117

    [2011.04.23 22:12:12 | 022,450,176 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.242

    [2011.04.23 22:12:10 | 023,216,128 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.269

    [2011.04.23 22:12:04 | 020,918,272 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_02.764

    [2011.04.23 22:06:26 | 000,200,704 | -H-- | M] (yfrPTYRO) -- C:\Users\бнс\AppData\Roaming\bt.exe

    [2011.04.23 22:06:26 | 000,200,704 | ---- | M] (yfrPTYRO) -- C:\Users\бнс\AppData\Roaming\audiohd.exe

    [2011.04.23 22:03:28 | 000,532,480 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\winserver.exe

    [2011.04.22 23:15:13 | 000,445,952 | ---- | M] (Extension) -- C:\Program Files\931DA.dll

    ========== Files Created - No Company Name ==========

    [2011.05.05 23:52:59 | 000,625,664 | ---- | C] () -- C:\Users\бнс\Desktop\dds.scr

    [2011.05.05 23:14:04 | 001,110,476 | ---- | C] () -- C:\Users\бнс\Desktop\7z920.exe

    [2011.05.05 22:55:59 | 000,879,081 | ---- | C] () -- C:\Users\бнс\Desktop\SecurityCheck.exe

    [2011.05.02 22:58:15 | 000,079,872 | -H-- | C] () -- C:\Users\бнс\AppData\Roaming\install.48918.exe

    [2011.05.02 22:37:51 | 000,000,000 | -H-- | C] () -- C:\Users\бнс\AppData\Roaming\gbot.exe

    [2011.05.02 22:36:21 | 000,000,000 | -H-- | C] () -- C:\Users\бнс\AppData\Roaming\your_exe(2).exe

    [2011.05.02 22:28:11 | 000,000,000 | -H-- | C] () -- C:\Users\бнс\AppData\Roaming\thebot.exe

    [2011.05.01 23:41:30 | 000,147,374 | -H-- | C] () -- C:\Users\бнс\AppData\Roaming\fud.exe

    [2011.05.01 22:21:54 | 000,002,264 | ---- | C] () -- C:\Users\бнс\Desktop\Google Chrome.lnk

    [2011.05.01 22:09:33 | 000,001,000 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4294071207-530640845-1734815284-1000UA.job

    [2011.05.01 22:09:32 | 000,000,948 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4294071207-530640845-1734815284-1000Core.job

    [2011.04.29 20:55:40 | 000,181,760 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\dwmu.exe

    [2011.04.28 00:36:31 | 000,000,000 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe

    [2011.04.28 00:36:21 | 000,000,000 | ---- | C] () -- C:\Windows\System32\b33.exe

    [2011.04.27 23:29:05 | 000,000,000 | ---- | C] () -- C:\Windows\ddx.exe

    [2011.04.27 23:29:03 | 000,000,000 | ---- | C] () -- C:\Windows\9.exe

    [2011.04.27 23:27:26 | 196,386,294 | ---- | C] () -- C:\Windows\MEMORY.DMP

    [2011.04.27 23:26:17 | 000,058,976 | ---- | C] () -- C:\Windows\System32\drivers\srenum.sys

    [2011.04.27 23:26:17 | 000,004,128 | ---- | C] () -- C:\Windows\System32\msrun.exe

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | C] () -- C:\IO.SYS

    [2011.04.27 23:26:03 | 000,000,017 | ---- | C] () -- C:\Windows\keys.ini

    [2011.04.27 23:23:54 | 000,028,294 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\data.dat

    [2011.04.27 23:23:39 | 000,008,700 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\881E.EC9

    [2011.04.26 21:29:06 | 000,061,440 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\chrtmp

    [2011.04.25 22:57:33 | 001,305,170 | -H-- | C] () -- C:\Users\бнс\AppData\Roaming\o.exe

    [2011.04.25 22:43:07 | 001,305,170 | -H-- | C] () -- C:\Users\бнс\AppData\Roaming\25-Apr-11-427166d40c29819-o.exe

    [2011.04.24 23:36:06 | 001,299,580 | -H-- | C] () -- C:\Users\бнс\AppData\Roaming\I.exe

    [2011.04.23 22:21:40 | 000,147,456 | ---- | C] () -- C:\Windows\System32\__rzi_00.827

    [2011.04.23 22:21:40 | 000,065,536 | ---- | C] () -- C:\Windows\System32\__rzi_01.605

    [2011.04.23 22:21:40 | 000,065,536 | ---- | C] () -- C:\Windows\System32\__rzi_01.073

    [2011.04.23 22:21:40 | 000,065,536 | ---- | C] () -- C:\Windows\System32\__rzi_01.067

    [2011.04.23 22:21:40 | 000,065,536 | ---- | C] () -- C:\Windows\System32\__rzi_00.870

    [2011.04.23 22:21:40 | 000,065,536 | ---- | C] () -- C:\Windows\System32\__rzi_00.198

    [2011.04.23 22:21:40 | 000,032,768 | ---- | C] () -- C:\Windows\System32\__rzi_00.824

    [2011.04.23 22:20:39 | 003,092,480 | ---- | C] () -- C:\Windows\System32\__rzi_15.653

    [2011.04.23 22:18:33 | 030,502,912 | ---- | C] () -- C:\Windows\System32\__rzi_00.985

    [2011.04.23 22:18:23 | 027,553,792 | ---- | C] () -- C:\Windows\System32\__rzi_01.706

    [2011.04.23 22:18:19 | 035,872,768 | ---- | C] () -- C:\Windows\System32\__rzi_01.264

    [2011.04.23 22:18:18 | 028,033,024 | ---- | C] () -- C:\Windows\System32\__rzi_02.356

    [2011.04.23 22:18:16 | 036,331,520 | ---- | C] () -- C:\Windows\System32\__rzi_00.878

    [2011.04.23 22:18:15 | 041,709,568 | ---- | C] () -- C:\Windows\System32\__rzi_00.038

    [2011.04.23 22:14:01 | 000,196,608 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.336

    [2011.04.23 22:13:59 | 000,888,832 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.956

    [2011.04.23 22:13:59 | 000,705,511 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rar_00.584

    [2011.04.23 22:13:53 | 002,174,976 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.959

    [2011.04.23 22:13:37 | 003,517,044 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rar_00.944

    [2011.04.23 22:12:57 | 004,673,536 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_04.280

    [2011.04.23 22:12:53 | 011,685,888 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.515

    [2011.04.23 22:12:50 | 007,393,280 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.170

    [2011.04.23 22:12:47 | 013,746,176 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.623

    [2011.04.23 22:12:47 | 013,025,280 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.821

    [2011.04.23 22:12:47 | 012,304,384 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.654

    [2011.04.23 22:12:44 | 013,348,864 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.089

    [2011.04.23 22:12:42 | 009,576,448 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.354

    [2011.04.23 22:12:34 | 012,976,128 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.099

    [2011.04.23 22:12:33 | 011,993,088 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.110

    [2011.04.23 22:12:25 | 015,749,120 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.744

    [2011.04.23 22:12:25 | 013,811,712 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.734

    [2011.04.23 22:12:24 | 013,902,940 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.161

    [2011.04.23 22:12:21 | 017,207,296 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.117

    [2011.04.23 22:12:12 | 022,450,176 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.242

    [2011.04.23 22:12:10 | 023,216,128 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.269

    [2011.04.23 22:12:04 | 020,918,272 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\__rzi_02.764

    [2011.04.23 22:03:34 | 000,016,384 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\svchost.exe

    [2011.04.23 22:03:22 | 000,532,480 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\winserver.exe

    [2011.04.20 19:23:31 | 443,797,508 | ---- | C] () -- C:\Users\бнс\Desktop\Обединена Велика България 1941.mpg

    [2011.03.22 15:32:27 | 000,046,742 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\room.dat

    [2011.02.16 18:12:58 | 000,077,333 | ---- | C] () -- C:\Windows\War3Unin.dat

    [2010.03.30 20:16:49 | 000,000,000 | ---- | C] () -- C:\Program Files\error.dat

    [2010.03.15 19:59:31 | 000,000,048 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat

    [2010.03.04 19:27:43 | 000,027,019 | ---- | C] () -- C:\Windows\maxlink.ini

    [2010.02.27 16:58:18 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

    [2009.12.16 18:34:12 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

    [2009.07.14 07:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

    [2009.07.14 07:33:53 | 003,762,928 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

    [2009.07.14 05:05:48 | 000,616,546 | ---- | C] () -- C:\Windows\System32\perfh009.dat

    [2009.07.14 05:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

    [2009.07.14 05:05:48 | 000,106,926 | ---- | C] () -- C:\Windows\System32\perfc009.dat

    [2009.07.14 05:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

    [2009.07.14 05:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

    [2009.07.14 05:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

    [2009.07.14 02:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

    [2009.07.14 02:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

    [2009.07.14 02:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

    [2009.07.14 01:09:19 | 001,498,564 | ---- | C] () -- C:\Windows\System32\igkrng400.bin

    [2009.06.11 00:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

    [2002.03.04 11:16:34 | 000,110,592 | R--- | C] () -- C:\Windows\System32\Jpeg32.dll

    ========== LOP Check ==========

    [2011.04.28 02:46:03 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\AVG10

    [2010.02.27 17:32:06 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\DAEMON Tools Lite

    [2011.04.22 23:12:09 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\Darer

    [2010.03.25 15:05:59 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\Leadertech

    [2011.04.28 01:59:38 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\updates

    [2011.05.06 14:23:51 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\uTorrent

    [2011.03.01 10:15:36 | 000,032,542 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========

    ========== Custom Scans ==========

    < %SYSTEMDRIVE%\*.* >

    [2009.06.11 00:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat

    [2009.06.11 00:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys

    [2011.05.06 14:02:51 | 797,433,856 | -HS- | M] () -- C:\hiberfil.sys

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

    [2011.05.06 14:02:56 | 1073,741,824 | -HS- | M] () -- C:\pagefile.sys

    < %PROGRAMFILES%\*.* >

    [2011.04.22 23:15:13 | 000,445,952 | ---- | M] (Extension) -- C:\Program Files\931DA.dll

    [2009.07.14 07:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

    [2010.03.30 20:16:49 | 000,000,000 | ---- | M] () -- C:\Program Files\error.dat

    < %systemroot%\system32\*.dll /lockedfiles >

    < %systemroot%\Tasks\*.job /lockedfiles >

    < End of report >

    Extras

    OTL Extras logfile created on: 6.5.2011 г. 14:25:50 - Run 1

    OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\бнс\Desktop

    Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

    Internet Explorer (Version = 8.0.7600.16385)

    Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'

    1 014,00 Mb Total Physical Memory | 561,00 Mb Available Physical Memory | 55,00% Memory free

    2,00 Gb Paging File | 1,00 Gb Available in Paging File | 67,00% Paging File free

    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

    Drive C: | 50,68 Gb Total Space | 33,46 Gb Free Space | 66,02% Space Free | Partition Type: NTFS

    Drive D: | 61,01 Gb Total Space | 47,69 Gb Free Space | 78,17% Space Free | Partition Type: NTFS

    Computer Name: БНС-PC | User Name: бнс | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users

    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========

    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Classes\<extension>]

    .html [@ = ChromeHTML] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

    batfile [open] -- "%1" %*

    cmdfile [open] -- "%1" %*

    comfile [open] -- "%1" %*

    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

    exefile [open] -- "%1" %*

    helpfile [open] -- Reg Error: Key error.

    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

    htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)

    htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)

    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

    piffile [open] -- "%1" %*

    regfile [merge] -- Reg Error: Key error.

    scrfile [config] -- "%1"

    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

    scrfile [open] -- "%1" /S

    txtfile [edit] -- Reg Error: Key error.

    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

    Directory [bridge] -- D:\асдад\Нова папка\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)

    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

    Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

    Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

    Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)

    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Folder [explore] -- Reg Error: Value error.

    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

    "cval" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    "VistaSp1" = Reg Error: Unknown registry data type -- File not found

    "AntiVirusOverride" = 0

    "AntiSpywareOverride" = 0

    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    "DisableNotifications" = 0

    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

    "DisableNotifications" = 0

    "EnableFirewall" = 0

    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

    "DisableNotifications" = 0

    "EnableFirewall" = 0

    "DoNotAllowExceptions" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

    "C:\Users\бнс\Desktop\facebook-pic00320123561.exe" = c:\windows\nvsvc32.exe:*:Enabled:NVIDIA driver monitor

    "C:\Users\бнс\AppData\Roaming\wusolsl.exe" = C:\Users\бнс\AppData\Roaming\wusolsl.exe:*:Enabled:Windows Messanger

    "C:\Users\9974~1\AppData\Local\Temp\82185.exe" = C:\Users\9974~1\AppData\Local\Temp\82185.exe:*:Enabled:Windows Messanger

    "C:\Users\бнс\AppData\Roaming\local.exe" = C:\Users\бнс\AppData\Roaming\local.exe:*:Enabled:Windows Messanger

    "C:\Users\бнс\AppData\Roaming\bot10.exe" = C:\Users\бнс\AppData\Roaming\bot10.exe:*:Enabled:Windows Messanger

    "C:\Users\9974~1\AppData\Local\Temp\52431.exe" = C:\Users\9974~1\AppData\Local\Temp\52431.exe:*:Enabled:Windows Messanger

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    "{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86

    "{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86

    "{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help

    "{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86

    "{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5

    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

    "{23E1DE84-4074-4DE3-AA31-C71E64F05BD4}" = Brother DCP-7010

    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

    "{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg

    "{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR

    "{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86

    "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

    "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar

    "{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

    "{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010

    "{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010

    "{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010

    "{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010

    "{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010

    "{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010

    "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

    "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

    "{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010

    "{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010

    "{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010

    "{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010

    "{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010

    "{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010

    "{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010

    "{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010

    "{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86

    "{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars

    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    "{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort

    "{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5

    "{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)

    "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2

    "{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86

    "{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86

    "{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player

    "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

    "7-Zip" = 7-Zip 9.20

    "Adobe AIR" = Adobe AIR

    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

    "chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help

    "com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player

    "Diablo II - Eastern Sun 3.00 Full" = Diablo II - Eastern Sun 3.00 Full

    "Garena" = Garena 2010

    "McAfee Security Scan" = McAfee Security Scan Plus

    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

    "Office14.PROPLUS" = Microsoft Office Professional Plus 2010

    "One" = One

    "SP6" = Logitech SetPoint 6.0

    "StoreHouse LITE_is1" = StoreHouse LITE 2.0.2-16

    "uTorrent" = µTorrent

    "VLC media player" = VLC media player 1.0.5

    "Warcraft III" = Warcraft III

    "Winamp" = Winamp

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    "Google Chrome" = Google Chrome

    "Warcraft III" = Warcraft III: All Products

    "Winamp Detect" = Winamp Detector Plug-in

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]

    Error - 27.4.2011 г. 18:52:03 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xac0 Начален час на приложението с грешки: 0x01cc052c51ccbd5e

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: f7431aa8-7120-11e0-adb8-001eec48393f

    Error - 27.4.2011 г. 18:54:21 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xd04 Начален час на приложението с грешки: 0x01cc052dc52ee3be

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: 4973d449-7121-11e0-adb8-001eec48393f

    Error - 27.4.2011 г. 19:00:57 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xcc4 Начален час на приложението с грешки: 0x01cc052ed014ccc9

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: 35b5d0a3-7122-11e0-aa7c-001eec48393f

    Error - 27.4.2011 г. 19:14:15 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xf48 Начален час на приложението с грешки: 0x01cc052f34db4ea3

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: 11123ecf-7124-11e0-aa7c-001eec48393f

    Error - 27.4.2011 г. 19:20:54 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0x628 Начален час на приложението с грешки: 0x01cc0530e32ad1c0

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: fee53ae5-7124-11e0-aa7c-001eec48393f

    Error - 27.4.2011 г. 19:21:31 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xb20 Начален час на приложението с грешки: 0x01cc0531c724fc93

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: 1581931a-7125-11e0-aa7c-001eec48393f

    Error - 27.4.2011 г. 19:21:57 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xf4c Начален час на приложението с грешки: 0x01cc0531d9f884b8

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: 24847b24-7125-11e0-aa7c-001eec48393f

    Error - 27.4.2011 г. 19:34:43 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xff8 Начален час на приложението с грешки: 0x01cc0533874f9a7d

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: ed5c3db4-7126-11e0-bcda-001eec48393f

    Error - 27.4.2011 г. 20:03:05 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0x1254 Начален час на приложението с грешки: 0x01cc05376a71fefd

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: e3ac4b23-712a-11e0-ae99-001eec48393f

    Error - 5.5.2011 г. 16:18:43 | Computer Name = бнс-PC | Source = Application Hang | ID = 1002

    Description = The program Skype.exe version 4.2.0.152 stopped interacting with Windows

    and was closed. To see if more information about the problem is available, check

    the problem history in the Action Center control panel. Process ID: 1768 Start Time:

    01cc0b5f7a3db475 Termination Time: 343 Application Path: C:\Program Files\Skype\Phone\Skype.exe

    Report

    Id:

    [ System Events ]

    Error - 5.5.2011 г. 15:48:53 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7031

    Description = Услуга Base Filtering Engine беше прекъсната неочаквано. Това се е

    случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното коригиращо

    действие: Рестартиране на услугата.

    Error - 5.5.2011 г. 15:48:53 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7031

    Description = Услуга Diagnostic Policy Service беше прекъсната неочаквано. Това

    се е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното

    коригиращо действие: Рестартиране на услугата.

    Error - 5.5.2011 г. 15:48:53 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7031

    Description = Услуга Защитна стена на Windows беше прекъсната неочаквано. Това се

    е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното

    коригиращо действие: Рестартиране на услугата.

    Error - 5.5.2011 г. 15:50:56 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7032

    Description = Диспечерът за управление на услуги се опита да предприеме коригиращо

    действие (Рестартиране на услугата) след неочакваното прекъсване на услуга Base

    Filtering Engine, но това действие се оказа неуспешно поради следната грешка: %%1056

    Error - 5.5.2011 г. 15:55:25 | Computer Name = бнс-PC | Source = Disk | ID = 262155

    Description = The driver detected a controller error on \Device\Harddisk1\DR2.

    Error - 5.5.2011 г. 15:55:25 | Computer Name = бнс-PC | Source = Disk | ID = 262155

    Description = The driver detected a controller error on \Device\Harddisk1\DR2.

    Error - 5.5.2011 г. 15:55:26 | Computer Name = бнс-PC | Source = Disk | ID = 262155

    Description = The driver detected a controller error on \Device\Harddisk1\DR2.

    Error - 5.5.2011 г. 15:55:27 | Computer Name = бнс-PC | Source = Disk | ID = 262155

    Description = The driver detected a controller error on \Device\Harddisk1\DR2.

    Error - 6.5.2011 г. 07:03:29 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7000

    Description = Услуга srenum не може да бъде стартирана поради следната грешка: %%2

    Error - 6.5.2011 г. 07:03:29 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7000

    Description = Услуга svcoolk не може да бъде стартирана поради следната грешка:

    %%2

    < End of report >

    Следва:

    Стъпка 1

    Стартирайте пак OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

    :otl
PRC - C:\Users\бнс\AppData\Roaming\507832571.exe (Larssss)
SRV - (svcoolk) -- File not found
DRV - (srenum) -- C:\Windows\System32\drivers\srenum.sys
IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
[2011.04.25 22:13:42 | 000,002,385 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\Mozilla\Firefox\Profiles\x25f4lpk.default\searchplugins\askcom.xml
O2 - BHO: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\..\Toolbar\WebBrowser: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000..\Run: [DriverLoader] C:\Users\бнс\AppData\Roaming\507832571.exe (Larssss)
O4 - HKLM..\Run: [conhost] File not found
O4 - HKLM..\Run: [Local] File not found
O4 - HKLM..\Run: [NVIDIA driver monitor] File not found
O4 - HKLM..\Run: [System] File not found
O4 - HKLM..\Run: [Win7Service] File not found
O4 - HKLM..\Run: [wuaplo] File not found
O4 - Startup: C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: Local = C:\Users\бнс\AppData\Roaming\local.exe
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: wuaplo = C:\Users\бнс\AppData\Roaming\wusolsl.exe
O20 - HKLM Winlogon: TaskMan - (C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-2734\ju7bd.exe) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
[2011.04.23 22:06:39 | 000,200,704 | ---- | C] (yfrPTYRO) -- C:\Users\бнс\AppData\Roaming\audiohd.exe
[2011.04.23 22:05:54 | 000,200,704 | -H-- | C] (yfrPTYRO) -- C:\Users\бнс\AppData\Roaming\bt.exe
[2011.04.22 23:15:13 | 000,445,952 | ---- | C] (Extension) -- C:\Program Files\931DA.dll
[2011.05.03 22:05:08 | 000,046,742 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\room.dat
[2011.05.02 22:58:22 | 000,079,872 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\install.48918.exe
[2011.05.02 22:37:51 | 000,000,000 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\gbot.exe
[2011.05.02 22:36:21 | 000,000,000 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\your_exe(2).exe
[2011.05.02 22:28:11 | 000,000,000 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\thebot.exe
[2011.05.02 20:31:47 | 000,008,700 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\881E.EC9
[2011.05.01 23:41:33 | 000,147,374 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\fud.exe
[2011.05.01 23:31:58 | 000,028,294 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\data.dat
[2011.04.28 02:36:56 | 005,497,592 | ---- | M] (AVG Technologies) -- C:\Users\бнс\Desktop\avg_free_stb_all_2011_1321_cnet.exe
[2011.04.28 01:59:30 | 000,000,000 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe
[2011.04.28 01:59:30 | 000,000,000 | ---- | M] () -- C:\Windows\System32\b33.exe
[2011.04.27 23:29:05 | 000,000,000 | ---- | M] () -- C:\Windows\ddx.exe
[2011.04.27 23:29:03 | 000,000,000 | ---- | M] () -- C:\Windows\9.exe
[2011.04.27 23:26:17 | 000,058,976 | ---- | M] () -- C:\Windows\System32\drivers\srenum.sys
[2011.04.27 23:26:17 | 000,004,128 | ---- | M] () -- C:\Windows\System32\msrun.exe
[2011.04.27 23:26:03 | 000,000,017 | ---- | M] () -- C:\Windows\keys.ini
[2011.04.27 23:24:03 | 000,181,760 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\dwmu.exe
[2011.04.27 23:23:44 | 000,192,512 | RHS- | M] (Larssss) -- C:\Users\бнс\AppData\Roaming\507832571.exe
[2011.04.25 23:05:21 | 001,305,170 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\o.exe
[2011.04.25 22:43:10 | 001,305,170 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\25-Apr-11-427166d40c29819-o.exe
[2011.04.25 22:27:03 | 000,061,440 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\chrtmp
[2011.04.24 23:36:18 | 001,299,580 | -H-- | M] () -- C:\Users\бнс\AppData\Roaming\I.exe
[2011.04.24 21:46:41 | 000,016,384 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\svchost.exe
[2011.04.23 22:21:40 | 000,147,456 | ---- | M] () -- C:\Windows\System32\__rzi_00.827
[2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_01.605
[2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_01.073
[2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_01.067
[2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_00.870
[2011.04.23 22:21:40 | 000,065,536 | ---- | M] () -- C:\Windows\System32\__rzi_00.198
[2011.04.23 22:21:40 | 000,032,768 | ---- | M] () -- C:\Windows\System32\__rzi_00.824
[2011.04.23 22:20:39 | 003,092,480 | ---- | M] () -- C:\Windows\System32\__rzi_15.653
[2011.04.23 22:18:33 | 030,502,912 | ---- | M] () -- C:\Windows\System32\__rzi_00.985
[2011.04.23 22:18:23 | 027,553,792 | ---- | M] () -- C:\Windows\System32\__rzi_01.706
[2011.04.23 22:18:19 | 035,872,768 | ---- | M] () -- C:\Windows\System32\__rzi_01.264
[2011.04.23 22:18:18 | 028,033,024 | ---- | M] () -- C:\Windows\System32\__rzi_02.356
[2011.04.23 22:18:16 | 036,331,520 | ---- | M] () -- C:\Windows\System32\__rzi_00.878
[2011.04.23 22:18:15 | 041,709,568 | ---- | M] () -- C:\Windows\System32\__rzi_00.038
[2011.04.23 22:14:01 | 000,196,608 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.336
[2011.04.23 22:13:59 | 000,888,832 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.956
[2011.04.23 22:13:59 | 000,705,511 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rar_00.584
[2011.04.23 22:13:58 | 013,902,940 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.161
[2011.04.23 22:13:53 | 002,174,976 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.959
[2011.04.23 22:13:37 | 003,517,044 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rar_00.944
[2011.04.23 22:12:57 | 004,673,536 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_04.280
[2011.04.23 22:12:53 | 011,685,888 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.515
[2011.04.23 22:12:50 | 007,393,280 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.170
[2011.04.23 22:12:47 | 013,746,176 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.623
[2011.04.23 22:12:47 | 013,025,280 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.821
[2011.04.23 22:12:47 | 012,304,384 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.654
[2011.04.23 22:12:44 | 013,348,864 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.089
[2011.04.23 22:12:42 | 009,576,448 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_03.354
[2011.04.23 22:12:34 | 012,976,128 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.099
[2011.04.23 22:12:33 | 011,993,088 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.110
[2011.04.23 22:12:25 | 015,749,120 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.744
[2011.04.23 22:12:25 | 013,811,712 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.734
[2011.04.23 22:12:21 | 017,207,296 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_01.117
[2011.04.23 22:12:12 | 022,450,176 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.242
[2011.04.23 22:12:10 | 023,216,128 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_00.269
[2011.04.23 22:12:04 | 020,918,272 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\__rzi_02.764
[2011.04.23 22:06:26 | 000,200,704 | -H-- | M] (yfrPTYRO) -- C:\Users\бнс\AppData\Roaming\bt.exe
[2011.04.23 22:06:26 | 000,200,704 | ---- | M] (yfrPTYRO) -- C:\Users\бнс\AppData\Roaming\audiohd.exe
[2011.04.23 22:03:28 | 000,532,480 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\winserver.exe
:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Users\бнс\Desktop\facebook-pic00320123561.exe" =-
"C:\Users\бнс\AppData\Roaming\wusolsl.exe" =-
"C:\Users\9974~1\AppData\Local\Temp\82185.exe" =-
"C:\Users\бнс\AppData\Roaming\local.exe" =- 
"C:\Users\бнс\AppData\Roaming\bot10.exe" =- 
"C:\Users\9974~1\AppData\Local\Temp\52431.exe" =-
:files
C:\Users\бнс\Desktop\facebook-pic00320123561.exe
C:\Users\бнс\AppData\Roaming\507832571.exe
C:\Users\9974~1\AppData\Local\Temp\82185.exe
C:\Users\бнс\AppData\Roaming\local.exe
C:\Users\бнс\AppData\Roaming\bot10.exe
C:\Users\9974~1\AppData\Local\Temp\52431.exe
recycler /alldrives
ipconfig /flushdns /c
:commands
[purity]
[resethosts]
[Reboot]
    След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

    Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

    Стъпка 2

    • Изтеглете Malwarebytes' Anti-Malware от тук, като изберете Download Free Version.
    • Кликнете два пъти върху mbam-setup.exe, за да инсталирате програмата. При инсталацията изберете английски език (English).
    • Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish. Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
    • Стартирайте програмата и изберете Perform Quick Scan, след това кликнете на Scan.
    • Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
    • Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
    • Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
    • Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

    Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

    •
    • Харесване 1
    • Автор

    Първо да питам когато пак отворя OTL.exe трябва ли да правя настройките от горния пост.Аз пробвах и в двата случая програмата забива и горе след версията на програмата пише : (не отговаря) а в долната лява част пише :Procesing DRV - (srenum) -- C:\Windows\Sistem32\drivers\srenum.sys....

    Добре, тогава следвайте инструкцията за работа с OTM:

    • Изтеглете OTМ.exe или OTМ.scr го запазете на десктопа.
    • Стартирайте ОТМ с двукратен клик на мишката (за Vista/Windows 7 - десен клик на файла и Run As Administrator).
    • Маркирайте следната текстова информация (само това, което е поставено в карето) и я копирайте с десен клик - Copy (Копирай). Може да използвате Ctrl+C:

      :services
svcoolk
srenum
:files
C:\Users\бнс\Desktop\facebook-pic00320123561.exe
C:\Users\9974~1\AppData\Local\Temp\82185.exe
C:\Users\бнс\AppData\Roaming\bot10.exe
C:\Users\9974~1\AppData\Local\Temp\52431.exe
C:\Users\бнс\AppData\Roaming\507832571.exe
C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe
C:\Users\бнс\AppData\Roaming\local.exe
C:\Users\бнс\AppData\Roaming\wusolsl.exe
C:\Users\бнс\AppData\Roaming\audiohd.exe
C:\Users\бнс\AppData\Roaming\bt.exe
C:\Program Files\931DA.dll
C:\Users\бнс\AppData\Roaming\room.dat
C:\Users\бнс\AppData\Roaming\install.48918.exe
C:\Users\бнс\AppData\Roaming\gbot.exe
C:\Users\бнс\AppData\Roaming\your_exe(2).exe
C:\Users\бнс\AppData\Roaming\thebot.exe
C:\Users\бнс\AppData\Roaming\881E.EC9
C:\Users\бнс\AppData\Roaming\fud.exe
C:\Users\бнс\AppData\Roaming\data.dat
C:\Users\бнс\Desktop\avg_free_stb_all_2011_1321_cnet.exe
C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe
C:\Windows\System32\b33.exe
C:\Windows\ddx.exe
C:\Windows\9.exe
C:\Windows\System32\drivers\srenum.sys
C:\Windows\System32\msrun.exe
C:\Windows\keys.ini
C:\Users\бнс\AppData\Roaming\dwmu.exe
C:\Users\бнс\AppData\Roaming\507832571.exe
C:\Users\бнс\AppData\Roaming\o.exe
C:\Users\бнс\AppData\Roaming\25-Apr-11-427166d40c29819-o.exe
C:\Users\бнс\AppData\Roaming\chrtmp
C:\Users\бнс\AppData\Roaming\I.exe
C:\Users\бнс\AppData\Roaming\svchost.exe
C:\Windows\System32\__rzi_00.827
C:\Windows\System32\__rzi_01.605
C:\Windows\System32\__rzi_01.073
C:\Windows\System32\__rzi_01.067
C:\Windows\System32\__rzi_00.870
C:\Windows\System32\__rzi_00.198
C:\Windows\System32\__rzi_00.824
C:\Windows\System32\__rzi_15.653
C:\Windows\System32\__rzi_00.985
C:\Windows\System32\__rzi_01.706
C:\Windows\System32\__rzi_01.264
C:\Windows\System32\__rzi_02.356
C:\Windows\System32\__rzi_00.878
C:\Windows\System32\__rzi_00.038
C:\Users\бнс\AppData\Roaming\__rzi_00.336
C:\Users\бнс\AppData\Roaming\__rzi_00.956
C:\Users\бнс\AppData\Roaming\__rar_00.584
C:\Users\бнс\AppData\Roaming\__rzi_01.161
C:\Users\бнс\AppData\Roaming\__rzi_00.959
C:\Users\бнс\AppData\Roaming\__rar_00.944
C:\Users\бнс\AppData\Roaming\__rzi_04.280
C:\Users\бнс\AppData\Roaming\__rzi_03.515
C:\Users\бнс\AppData\Roaming\__rzi_03.170
C:\Users\бнс\AppData\Roaming\__rzi_00.623
C:\Users\бнс\AppData\Roaming\__rzi_00.821
C:\Users\бнс\AppData\Roaming\__rzi_00.654
C:\Users\бнс\AppData\Roaming\__rzi_00.089
C:\Users\бнс\AppData\Roaming\__rzi_03.354
C:\Users\бнс\AppData\Roaming\__rzi_01.099
C:\Users\бнс\AppData\Roaming\__rzi_01.110
C:\Users\бнс\AppData\Roaming\__rzi_00.744
C:\Users\бнс\AppData\Roaming\__rzi_01.734
C:\Users\бнс\AppData\Roaming\__rzi_01.117
C:\Users\бнс\AppData\Roaming\__rzi_00.242
C:\Users\бнс\AppData\Roaming\__rzi_00.269
C:\Users\бнс\AppData\Roaming\__rzi_02.764
C:\Users\бнс\AppData\Roaming\bt.exe
C:\Users\бнс\AppData\Roaming\audiohd.exe
C:\Users\бнс\AppData\Roaming\winserver.exe
:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Users\бнс\Desktop\facebook-pic00320123561.exe" =-
"C:\Users\бнс\AppData\Roaming\wusolsl.exe" =-
"C:\Users\9974~1\AppData\Local\Temp\82185.exe" =-
"C:\Users\бнс\AppData\Roaming\local.exe" =- 
"C:\Users\бнс\AppData\Roaming\bot10.exe" =- 
"C:\Users\9974~1\AppData\Local\Temp\52431.exe" =-
:commands
[purity]
[resethosts]
[Reboot]
    • Отидете отново на стартирания OTM и с десен клик в Paste Instructions for Items to be Moved (под жълтата лента) и изберете Paste (Постави).
    • Натиснете маркираният в червено бутон Moveit!.
    • Изчакайте програмата да завърши работата си. Маркирайте и копирайте с десен клик Copy (Копирай или Ctrl+С) изцяло текста, който ще се появи под сивата лента.
    • Публикувайте копирания текст с Paste (постави) в следващия си коментар.
    • Затворете OTM.
    Забележка: Ако OTM изисква рестарт, изберете Yes. След рестарта отворете Notepad (Start-> All Programs -> Accessories -> Notepad) изберете File->Open, после в File Name въведете *.log и отидете в папка C:\_OTM\MovedFiles и отворете последния генериран файл с разширение log (mmddyyyy_hhmmss.log - тук mm е месец, dd - ден, yyyy - година, hh - час, mm - минута и ss - секунда). Маркирайте и копирайте с десен клик Copy (Копирай или Ctrl+С) изцяло текста, който се съдържа в този файл. Публикувайте копирания текст с Paste (Постави) в следващия си коментар.
    • Харесване 1
    • Автор

    ========== SERVICES/DRIVERS ==========

    Error: No service named svcoolk was found to stop!

    Service\Driver key svcoolk not found.

    Service srenum stopped successfully!

    Service srenum deleted successfully!

    ========== FILES ==========

    File/Folder C:\Users\бнс\Desktop\facebook-pic00320123561.exe not found.

    C:\Users\9974~1\AppData\Local\Temp\82185.exe moved successfully.

    File/Folder C:\Users\бнс\AppData\Roaming\bot10.exe not found.

    File/Folder C:\Users\9974~1\AppData\Local\Temp\52431.exe not found.

    File/Folder C:\Users\бнс\AppData\Roaming\507832571.exe not found.

    C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe moved successfully.

    File/Folder C:\Users\бнс\AppData\Roaming\local.exe not found.

    File/Folder C:\Users\бнс\AppData\Roaming\wusolsl.exe not found.

    C:\Users\бнс\AppData\Roaming\audiohd.exe moved successfully.

    C:\Users\бнс\AppData\Roaming\bt.exe moved successfully.

    C:\Program Files\931DA.dll moved successfully.

    C:\Users\бнс\AppData\Roaming\room.dat moved successfully.

    C:\Users\бнс\AppData\Roaming\install.48918.exe moved successfully.

    C:\Users\бнс\AppData\Roaming\gbot.exe moved successfully.

    C:\Users\бнс\AppData\Roaming\your_exe(2).exe moved successfully.

    C:\Users\бнс\AppData\Roaming\thebot.exe moved successfully.

    C:\Users\бнс\AppData\Roaming\881E.EC9 moved successfully.

    C:\Users\бнс\AppData\Roaming\fud.exe moved successfully.

    C:\Users\бнс\AppData\Roaming\data.dat moved successfully.

    C:\Users\бнс\Desktop\avg_free_stb_all_2011_1321_cnet.exe moved successfully.

    File/Folder C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mousedriver.exe not found.

    C:\Windows\System32\b33.exe moved successfully.

    C:\Windows\ddx.exe moved successfully.

    C:\Windows\9.exe moved successfully.

    C:\Windows\System32\drivers\srenum.sys moved successfully.

    C:\Windows\System32\msrun.exe moved successfully.

    C:\Windows\keys.ini moved successfully.

    C:\Users\бнс\AppData\Roaming\dwmu.exe moved successfully.

    File/Folder C:\Users\бнс\AppData\Roaming\507832571.exe not found.

    C:\Users\бнс\AppData\Roaming\o.exe moved successfully.

    C:\Users\бнс\AppData\Roaming\25-Apr-11-427166d40c29819-o.exe moved successfully.

    C:\Users\бнс\AppData\Roaming\chrtmp moved successfully.

    C:\Users\бнс\AppData\Roaming\I.exe moved successfully.

    C:\Users\бнс\AppData\Roaming\svchost.exe moved successfully.

    C:\Windows\System32\__rzi_00.827 moved successfully.

    C:\Windows\System32\__rzi_01.605 moved successfully.

    C:\Windows\System32\__rzi_01.073 moved successfully.

    C:\Windows\System32\__rzi_01.067 moved successfully.

    C:\Windows\System32\__rzi_00.870 moved successfully.

    C:\Windows\System32\__rzi_00.198 moved successfully.

    C:\Windows\System32\__rzi_00.824 moved successfully.

    C:\Windows\System32\__rzi_15.653 moved successfully.

    C:\Windows\System32\__rzi_00.985 moved successfully.

    C:\Windows\System32\__rzi_01.706 moved successfully.

    C:\Windows\System32\__rzi_01.264 moved successfully.

    C:\Windows\System32\__rzi_02.356 moved successfully.

    C:\Windows\System32\__rzi_00.878 moved successfully.

    C:\Windows\System32\__rzi_00.038 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.336 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.956 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rar_00.584 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_01.161 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.959 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rar_00.944 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_04.280 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_03.515 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_03.170 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.623 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.821 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.654 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.089 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_03.354 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_01.099 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_01.110 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.744 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_01.734 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_01.117 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.242 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_00.269 moved successfully.

    C:\Users\бнс\AppData\Roaming\__rzi_02.764 moved successfully.

    File/Folder C:\Users\бнс\AppData\Roaming\bt.exe not found.

    File/Folder C:\Users\бнс\AppData\Roaming\audiohd.exe not found.

    C:\Users\бнс\AppData\Roaming\winserver.exe moved successfully.

    ========== REGISTRY ==========

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\бнс\Desktop\facebook-pic00320123561.exe" not found.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\бнс\AppData\Roaming\wusolsl.exe" not found.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\9974~1\AppData\Local\Temp\82185.exe" not found.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\бнс\AppData\Roaming\local.exe" not found.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\бнс\AppData\Roaming\bot10.exe" not found.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\9974~1\AppData\Local\Temp\52431.exe" not found.

    ========== COMMANDS ==========

    C:\Windows\System32\drivers\etc\Hosts moved successfully.

    HOSTS file reset successfully

    OTM by OldTimer - Version 3.1.17.2 log created on 05062011_164036

    •
    • Харесване 1
    • Автор

    Malwarebytes' Anti-Malware 1.50.1.1100

    www.malwarebytes.org

    Database version: 6519

    Windows 6.1.7600

    Internet Explorer 8.0.7600.16385

    6.5.2011 г. 17:03:00

    mbam-log-2011-05-06 (17-03-00).txt

    Scan type: Quick scan

    Objects scanned: 136970

    Time elapsed: 3 minute(s), 18 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 4

    Registry Values Infected: 8

    Registry Data Items Infected: 0

    Folders Infected: 1

    Files Infected: 9

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4CF558B-745C-44FF-854F-D6FCAE69B6E1} (Adware.Fluxeos.B) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4CF558B-745C-44FF-854F-D6FCAE69B6E1} (Adware.Fluxeos.B) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\Software\VB and VBA Program Settings\SrvID (Malware.Trace) -> Quarantined and deleted successfully.

    Registry Values Infected:

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\engel (Backdoor.Bot) -> Value: engel -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor (Backdoor.Agent) -> Value: NVIDIA driver monitor -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman (Trojan.Agent) -> Value: Taskman -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Local (Backdoor.Agent) -> Value: Local -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor (Backdoor.Agent) -> Value: NVIDIA driver monitor -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System (Trojan.FakeAlert) -> Value: System -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Trojan.Agent) -> Value: conhost -> Quarantined and deleted successfully.

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    c:\RECYCLER\r-1-5-21-1482476501-1644491937-682003330-1013 (Worm.AutoRun.Gen) -> Quarantined and deleted successfully.

    Files Infected:

    c:\Users\бнс\AppData\Local\Temp\21775.exe (Backdoor.Agent) -> Quarantined and deleted successfully.

    c:\Users\бнс\AppData\Local\Temp\xqAP016.exe (Trojan.Agent.ND) -> Quarantined and deleted successfully.

    c:\Users\бнс\AppData\Local\Temp\81691.exe (Backdoor.Agent) -> Quarantined and deleted successfully.

    c:\Windows\Temp\temp9872.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

    c:\Users\бнс\AppData\Local\Temp\pws_cdk.bss (Stolen.Data) -> Quarantined and deleted successfully.

    c:\Users\бнс\AppData\Local\Temp\pws_mail.bss (Stolen.Data) -> Quarantined and deleted successfully.

    c:\Users\бнс\AppData\Local\Temp\pws_mess.bss (Stolen.Data) -> Quarantined and deleted successfully.

    c:\Users\бнс\AppData\Roaming\updates\updates.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

    c:\RECYCLER\r-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Worm.AutoRun.Gen) -> Quarantined and deleted successfully.

    •
    • Харесване 1

    Хм, Malwarebytes' Anti-Malware свърши добра работа. Сега ще ми трябва още един лог от OTL, съгласно инструкцията в коментар №4, но без да изтегляте отново OTL.exe P.S. Сега има ли някаква промяна в работата на Windows, след като почистихме?

    • Автор

    Ами определено работи по добре.

    OTL logfile created on: 6.5.2011 г. 17:20:38 - Run 2

    OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\бнс\Desktop

    Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

    Internet Explorer (Version = 8.0.7600.16385)

    Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'

    1 014,00 Mb Total Physical Memory | 514,00 Mb Available Physical Memory | 51,00% Memory free

    2,00 Gb Paging File | 1,00 Gb Available in Paging File | 66,00% Paging File free

    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

    Drive C: | 50,68 Gb Total Space | 33,30 Gb Free Space | 65,70% Space Free | Partition Type: NTFS

    Drive D: | 61,01 Gb Total Space | 47,69 Gb Free Space | 78,17% Space Free | Partition Type: NTFS

    Computer Name: БНС-PC | User Name: бнс | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users

    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Users\бнс\Desktop\OTL.exe (OldTimer Tools)

    PRC - C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE (Logitech, Inc.)

    PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

    PRC - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

    PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)

    PRC - C:\Windows\explorer.exe (Microsoft Corporation)

    PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

    PRC - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

    ========== Modules (SafeList) ==========

    MOD - C:\Users\бнс\Desktop\OTL.exe (OldTimer Tools)

    MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

    ========== Win32 Services (SafeList) ==========

    SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)

    SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

    SRV - (LBTServ) -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe (Logitech, Inc.)

    SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)

    SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)

    SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

    SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

    SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

    ========== Driver Services (SafeList) ==========

    DRV - (GGSAFERDriver) -- File not found

    DRV - (dtscsi) -- C:\Windows\System32\Drivers\dtscsi.sys (DT Soft Ltd.)

    DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()

    DRV - (vpcvmm) -- C:\Windows\System32\drivers\vpcvmm.sys (Microsoft Corporation)

    DRV - (vpcbus) -- C:\Windows\System32\drivers\vpchbus.sys (Microsoft Corporation)

    DRV - (vpcusb) -- C:\Windows\System32\drivers\vpcusb.sys (Microsoft Corporation)

    DRV - (vpcnfltr) -- C:\Windows\System32\drivers\vpcnfltr.sys (Microsoft Corporation)

    DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)

    DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)

    DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)

    DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)

    DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)

    DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)

    DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)

    DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)

    DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)

    DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)

    DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

    ========== Standard Registry (SafeList) ==========

    ========== Internet Explorer ==========

    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fullarticles.net

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = bg

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AE A2 34 6F B4 B7 CA 01 [binary data]

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

    IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultengine: "Ask.com"

    FF - prefs.js..browser.search.defaultenginename: "Ask.com"

    FF - prefs.js..browser.search.order.1: "Ask.com"

    FF - prefs.js..browser.search.selectedEngine: "Ask.com"

    FF - prefs.js..browser.search.useDBForOrder: true

    FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198

    FF - prefs.js..extensions.enabledItems: [email protected]:3.11.3.15590

    FF - prefs.js..extensions.enabledItems: {6b35a719-2cbb-4834-8538-7ac1d19a9664}:1.0.0

    FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=CDS&o=16205&locale=en_US&apn_uid=B3B0287F-6821-4F0B-9372-1BEFBF88607D&apn_ptnrs=QR&apn_sauid=3378F2F6-DA93-41A9-95C2-76261C47FD13&apn_dtid=&q="

    FF - prefs.js..network.proxy.http: "127.0.0.1"

    FF - prefs.js..network.proxy.http_port: 51636

    FF - prefs.js..network.proxy.type: 1

    [2010.02.27 16:58:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\бнс\AppData\Roaming\mozilla\Extensions

    [2011.04.25 20:21:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions

    [2011.03.21 13:05:23 | 000,000,000 | ---D | M] (CrowdStar Gamebar) -- C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]

    [2011.04.25 22:13:42 | 000,002,385 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\Mozilla\Firefox\Profiles\x25f4lpk.default\searchplugins\askcom.xml

    [2011.04.25 22:16:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

    [2011.04.22 23:15:13 | 000,000,000 | ---D | M] () -- C:\Program Files\mozilla firefox\extensions\{6b35a719-2cbb-4834-8538-7ac1d19a9664}

    [2010.02.27 17:43:34 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

    File not found (No name found) -- C:\USERS\Р±РЅСЃ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\X25F4LPK.DEFAULT\EXTENSIONS\[email protected]

    O1 HOSTS File: ([2011.05.06 16:40:39 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

    O1 - Hosts: 127.0.0.1 localhost

    O1 - Hosts: ::1 localhost

    O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

    O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

    O2 - BHO: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

    O3 - HKLM\..\Toolbar: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

    O3 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\..\Toolbar\WebBrowser: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)

    O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

    O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

    O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)

    O4 - HKLM..\Run: [bCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

    O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)

    O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

    O4 - HKLM..\Run: [Local] File not found

    O4 - HKLM..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

    O4 - HKLM..\Run: [Win7Service] File not found

    O4 - HKLM..\Run: [wuaplo] File not found

    O4 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

    O4 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)

    O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

    O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

    O4 - Startup: C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: wuaplo = C:\Users\бнс\AppData\Roaming\wusolsl.exe

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

    O7 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

    O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

    O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

    O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

    O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

    O13 - gopher Prefix: missing

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

    O20 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000 Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

    O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

    O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)

    O32 - HKLM CDRom: AutoRun - 1

    O32 - AutoRun File - [2009.06.11 00:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

    O34 - HKLM BootExecute: (autocheck autochk *) - File not found

    O35 - HKLM\..comfile [open] -- "%1" %*

    O35 - HKLM\..exefile [open] -- "%1" %*

    O37 - HKLM\...com [@ = comfile] -- "%1" %*

    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: FastUserSwitchingCompatibility - File not found

    NetSvcs: Ias - File not found

    NetSvcs: Nla - File not found

    NetSvcs: Ntmssvc - File not found

    NetSvcs: NWCWorkstation - File not found

    NetSvcs: Nwsapagent - File not found

    NetSvcs: SRService - File not found

    NetSvcs: WmdmPmSp - File not found

    NetSvcs: LogonHours - File not found

    NetSvcs: PCAudit - File not found

    NetSvcs: helpsvc - File not found

    NetSvcs: uploadmgr - File not found

    Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)

    Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)

    Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)

    Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)

    Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)

    Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

    Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)

    Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)

    Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)

    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

    Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)

    Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)

    Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)

    Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)

    Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)

    Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)

    Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)

    Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)

    Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)

    Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

    ========== Files/Folders - Created Within 30 Days ==========

    [2011.05.06 16:57:59 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Malwarebytes

    [2011.05.06 16:57:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

    [2011.05.06 16:57:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

    [2011.05.06 16:57:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

    [2011.05.06 16:57:50 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

    [2011.05.06 16:57:50 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

    [2011.05.06 16:56:23 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\бнс\Desktop\mbam-setup.exe

    [2011.05.06 16:40:36 | 000,000,000 | ---D | C] -- C:\_OTM

    [2011.05.06 16:37:38 | 000,519,680 | ---- | C] (OldTimer Tools) -- C:\Users\бнс\Desktop\OTM.exe

    [2011.05.06 15:39:13 | 000,000,000 | ---D | C] -- C:\_OTL

    [2011.05.06 00:53:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi

    [2011.05.05 23:15:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

    [2011.05.05 23:14:34 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

    [2011.05.05 22:55:56 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\бнс\Desktop\OTL.exe

    [2011.05.01 22:21:49 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

    [2011.04.28 12:57:14 | 000,000,000 | -H-D | C] -- C:\$AVG

    [2011.04.28 02:46:03 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\AVG10

    [2011.04.28 02:45:26 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

    [2011.04.28 02:41:41 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG10

    [2011.04.28 02:40:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVG

    [2011.04.28 02:37:02 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData

    [2011.04.28 01:59:38 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\updates

    [2011.04.28 00:54:51 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II - Eastern Sun 3.00 Full

    [2011.04.27 23:27:41 | 000,000,000 | ---D | C] -- C:\Windows\Minidump

    [2011.04.27 23:25:19 | 000,000,000 | RHSD | C] -- C:\RECYCLER

    [2011.04.25 22:18:07 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Local\Google

    [2011.04.24 21:59:37 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\mIRC

    [2011.04.22 23:04:34 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Darer

    [2011.04.22 23:03:19 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Darer

    [2011.04.22 23:03:07 | 000,000,000 | ---D | C] -- C:\Program Files\Darer

    [2011.04.15 21:01:42 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Local\Apps

    [2011.04.15 21:01:41 | 000,000,000 | ---D | C] -- C:\Users\бнс\AppData\Local\Deployment

    ========== Files - Modified Within 30 Days ==========

    [2011.05.06 17:18:58 | 000,046,742 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\room.dat

    [2011.05.06 17:14:00 | 000,001,000 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4294071207-530640845-1734815284-1000UA.job

    [2011.05.06 17:12:22 | 000,017,360 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

    [2011.05.06 17:12:22 | 000,017,360 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

    [2011.05.06 17:05:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

    [2011.05.06 17:04:45 | 797,433,856 | -HS- | M] () -- C:\hiberfil.sys

    [2011.05.06 16:57:53 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

    [2011.05.06 16:56:25 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\бнс\Desktop\mbam-setup.exe

    [2011.05.06 16:40:39 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

    [2011.05.06 16:37:40 | 000,519,680 | ---- | M] (OldTimer Tools) -- C:\Users\бнс\Desktop\OTM.exe

    [2011.05.05 23:53:05 | 000,625,664 | ---- | M] () -- C:\Users\бнс\Desktop\dds.scr

    [2011.05.05 23:14:10 | 001,110,476 | ---- | M] () -- C:\Users\бнс\Desktop\7z920.exe

    [2011.05.05 22:54:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\бнс\Desktop\OTL.exe

    [2011.05.05 22:53:00 | 000,879,081 | ---- | M] () -- C:\Users\бнс\Desktop\SecurityCheck.exe

    [2011.05.05 22:45:07 | 000,000,948 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4294071207-530640845-1734815284-1000Core.job

    [2011.05.01 23:44:03 | 196,386,294 | ---- | M] () -- C:\Windows\MEMORY.DMP

    [2011.05.01 22:21:54 | 000,002,264 | ---- | M] () -- C:\Users\бнс\Desktop\Google Chrome.lnk

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

    [2011.04.27 16:37:12 | 000,616,546 | ---- | M] () -- C:\Windows\System32\perfh009.dat

    [2011.04.27 16:37:12 | 000,106,926 | ---- | M] () -- C:\Windows\System32\perfc009.dat

    [2011.04.23 22:17:13 | 014,291,787 | ---- | M] () -- C:\Users\бнс\Desktop\Снимки.rar

    ========== Files Created - No Company Name ==========

    [2011.05.06 17:18:58 | 000,046,742 | ---- | C] () -- C:\Users\бнс\AppData\Roaming\room.dat

    [2011.05.06 16:57:53 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

    [2011.05.05 23:52:59 | 000,625,664 | ---- | C] () -- C:\Users\бнс\Desktop\dds.scr

    [2011.05.05 23:14:04 | 001,110,476 | ---- | C] () -- C:\Users\бнс\Desktop\7z920.exe

    [2011.05.05 22:55:59 | 000,879,081 | ---- | C] () -- C:\Users\бнс\Desktop\SecurityCheck.exe

    [2011.05.01 22:21:54 | 000,002,264 | ---- | C] () -- C:\Users\бнс\Desktop\Google Chrome.lnk

    [2011.05.01 22:09:33 | 000,001,000 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4294071207-530640845-1734815284-1000UA.job

    [2011.05.01 22:09:32 | 000,000,948 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4294071207-530640845-1734815284-1000Core.job

    [2011.04.27 23:27:26 | 196,386,294 | ---- | C] () -- C:\Windows\MEMORY.DMP

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | C] () -- C:\IO.SYS

    [2011.04.20 19:23:31 | 443,797,508 | ---- | C] () -- C:\Users\бнс\Desktop\Обединена Велика България 1941.mpg

    [2011.02.16 18:12:58 | 000,077,333 | ---- | C] () -- C:\Windows\War3Unin.dat

    [2010.03.30 20:16:49 | 000,000,000 | ---- | C] () -- C:\Program Files\error.dat

    [2010.03.15 19:59:31 | 000,000,048 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat

    [2010.03.04 19:27:43 | 000,027,019 | ---- | C] () -- C:\Windows\maxlink.ini

    [2010.02.27 16:58:18 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

    [2009.12.16 18:34:12 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

    [2009.07.14 07:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

    [2009.07.14 07:33:53 | 003,762,928 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

    [2009.07.14 05:05:48 | 000,616,546 | ---- | C] () -- C:\Windows\System32\perfh009.dat

    [2009.07.14 05:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

    [2009.07.14 05:05:48 | 000,106,926 | ---- | C] () -- C:\Windows\System32\perfc009.dat

    [2009.07.14 05:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

    [2009.07.14 05:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

    [2009.07.14 05:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

    [2009.07.14 02:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

    [2009.07.14 02:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

    [2009.07.14 02:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

    [2009.07.14 01:09:19 | 001,498,564 | ---- | C] () -- C:\Windows\System32\igkrng400.bin

    [2009.06.11 00:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

    [2002.03.04 11:16:34 | 000,110,592 | R--- | C] () -- C:\Windows\System32\Jpeg32.dll

    ========== LOP Check ==========

    [2011.04.28 02:46:03 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\AVG10

    [2010.02.27 17:32:06 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\DAEMON Tools Lite

    [2011.04.22 23:12:09 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\Darer

    [2010.03.25 15:05:59 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\Leadertech

    [2011.05.06 17:03:00 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\updates

    [2011.05.06 17:19:52 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\uTorrent

    [2011.03.01 10:15:36 | 000,032,542 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========

    ========== Custom Scans ==========

    < %SYSTEMDRIVE%\*.* >

    [2009.06.11 00:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat

    [2009.06.11 00:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys

    [2011.05.06 17:04:45 | 797,433,856 | -HS- | M] () -- C:\hiberfil.sys

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

    [2011.04.27 23:26:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

    [2011.05.06 17:04:50 | 1073,741,824 | -HS- | M] () -- C:\pagefile.sys

    < %PROGRAMFILES%\*.* >

    [2009.07.14 07:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

    [2010.03.30 20:16:49 | 000,000,000 | ---- | M] () -- C:\Program Files\error.dat

    < %systemroot%\system32\*.dll /lockedfiles >

    < %systemroot%\Tasks\*.job /lockedfiles >

    < End of report >

    OTL Extras logfile created on: 6.5.2011 г. 17:20:38 - Run 2

    OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\бнс\Desktop

    Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

    Internet Explorer (Version = 8.0.7600.16385)

    Locale: 00000402 | Country: България | Language: BGR | Date Format: d.M.yyyy 'г.'

    1 014,00 Mb Total Physical Memory | 514,00 Mb Available Physical Memory | 51,00% Memory free

    2,00 Gb Paging File | 1,00 Gb Available in Paging File | 66,00% Paging File free

    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

    Drive C: | 50,68 Gb Total Space | 33,30 Gb Free Space | 65,70% Space Free | Partition Type: NTFS

    Drive D: | 61,01 Gb Total Space | 47,69 Gb Free Space | 78,17% Space Free | Partition Type: NTFS

    Computer Name: БНС-PC | User Name: бнс | Logged in as Administrator.

    Boot Mode: Normal | Scan Mode: All users

    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========

    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Classes\<extension>]

    .html [@ = ChromeHTML] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

    batfile [open] -- "%1" %*

    cmdfile [open] -- "%1" %*

    comfile [open] -- "%1" %*

    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

    exefile [open] -- "%1" %*

    helpfile [open] -- Reg Error: Key error.

    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

    htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)

    htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)

    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

    piffile [open] -- "%1" %*

    regfile [merge] -- Reg Error: Key error.

    scrfile [config] -- "%1"

    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

    scrfile [open] -- "%1" /S

    txtfile [edit] -- Reg Error: Key error.

    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

    Directory [bridge] -- D:\асдад\Нова папка\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)

    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

    Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

    Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

    Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)

    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Folder [explore] -- Reg Error: Value error.

    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

    "cval" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    "VistaSp1" = Reg Error: Unknown registry data type -- File not found

    "AntiVirusOverride" = 0

    "AntiSpywareOverride" = 0

    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    "DisableNotifications" = 0

    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

    "DisableNotifications" = 0

    "EnableFirewall" = 0

    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

    "DisableNotifications" = 0

    "EnableFirewall" = 0

    "DoNotAllowExceptions" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

    "C:\Users\бнс\Desktop\facebook-pic00320123561.exe" = c:\windows\nvsvc32.exe:*:Enabled:NVIDIA driver monitor

    "C:\Users\бнс\AppData\Roaming\wusolsl.exe" = C:\Users\бнс\AppData\Roaming\wusolsl.exe:*:Enabled:Windows Messanger

    "C:\Users\9974~1\AppData\Local\Temp\82185.exe" = C:\Users\9974~1\AppData\Local\Temp\82185.exe:*:Enabled:Windows Messanger

    "C:\Users\бнс\AppData\Roaming\local.exe" = C:\Users\бнс\AppData\Roaming\local.exe:*:Enabled:Windows Messanger

    "C:\Users\бнс\AppData\Roaming\bot10.exe" = C:\Users\бнс\AppData\Roaming\bot10.exe:*:Enabled:Windows Messanger

    "C:\Users\9974~1\AppData\Local\Temp\52431.exe" = C:\Users\9974~1\AppData\Local\Temp\52431.exe:*:Enabled:Windows Messanger

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    "{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86

    "{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86

    "{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help

    "{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86

    "{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5

    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

    "{23E1DE84-4074-4DE3-AA31-C71E64F05BD4}" = Brother DCP-7010

    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

    "{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg

    "{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR

    "{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86

    "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

    "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar

    "{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

    "{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010

    "{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010

    "{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010

    "{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010

    "{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010

    "{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010

    "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

    "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

    "{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010

    "{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010

    "{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010

    "{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010

    "{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010

    "{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010

    "{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010

    "{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010

    "{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86

    "{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars

    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    "{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort

    "{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5

    "{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)

    "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2

    "{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86

    "{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86

    "{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player

    "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

    "7-Zip" = 7-Zip 9.20

    "Adobe AIR" = Adobe AIR

    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

    "chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help

    "com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player

    "Diablo II - Eastern Sun 3.00 Full" = Diablo II - Eastern Sun 3.00 Full

    "Garena" = Garena 2010

    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

    "McAfee Security Scan" = McAfee Security Scan Plus

    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

    "Office14.PROPLUS" = Microsoft Office Professional Plus 2010

    "One" = One

    "SP6" = Logitech SetPoint 6.0

    "StoreHouse LITE_is1" = StoreHouse LITE 2.0.2-16

    "uTorrent" = µTorrent

    "VLC media player" = VLC media player 1.0.5

    "Warcraft III" = Warcraft III

    "Winamp" = Winamp

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-4294071207-530640845-1734815284-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    "Google Chrome" = Google Chrome

    "Warcraft III" = Warcraft III: All Products

    "Winamp Detect" = Winamp Detector Plug-in

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]

    Error - 27.4.2011 г. 19:20:54 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0x628 Начален час на приложението с грешки: 0x01cc0530e32ad1c0

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: fee53ae5-7124-11e0-aa7c-001eec48393f

    Error - 27.4.2011 г. 19:21:31 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xb20 Начален час на приложението с грешки: 0x01cc0531c724fc93

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: 1581931a-7125-11e0-aa7c-001eec48393f

    Error - 27.4.2011 г. 19:21:57 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xf4c Начален час на приложението с грешки: 0x01cc0531d9f884b8

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: 24847b24-7125-11e0-aa7c-001eec48393f

    Error - 27.4.2011 г. 19:34:43 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0xff8 Начален час на приложението с грешки: 0x01cc0533874f9a7d

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: ed5c3db4-7126-11e0-bcda-001eec48393f

    Error - 27.4.2011 г. 20:03:05 | Computer Name = бнс-PC | Source = Application Error | ID = 1000

    Description = Име на приложение с грешки: Diablo II.exe, версия: 1.0.0.1, времево

    клеймо: 0x3f9f275c Име на модул с грешки: D2Common.dll, версия: 0.0.0.0, времево

    клеймо: 0x3f7cb6cb Код на изключение: 0xc0000005 Отместване на грешка: 0x0004fa14

    ИД

    на процес на грешка: 0x1254 Начален час на приложението с грешки: 0x01cc05376a71fefd

    Път

    на приложението с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\Diablo

    II.exe Път на модула с грешки: D:\асдад\Diablo II\Diablo II - Eastern Sun 3.00\D2Common.dll

    ИД

    на доклад: e3ac4b23-712a-11e0-ae99-001eec48393f

    Error - 5.5.2011 г. 16:18:43 | Computer Name = бнс-PC | Source = Application Hang | ID = 1002

    Description = The program Skype.exe version 4.2.0.152 stopped interacting with Windows

    and was closed. To see if more information about the problem is available, check

    the problem history in the Action Center control panel. Process ID: 1768 Start Time:

    01cc0b5f7a3db475 Termination Time: 343 Application Path: C:\Program Files\Skype\Phone\Skype.exe

    Report

    Id:

    Error - 6.5.2011 г. 08:41:17 | Computer Name = бнс-PC | Source = Application Hang | ID = 1002

    Description = The program OTL.exe version 3.2.22.3 stopped interacting with Windows

    and was closed. To see if more information about the problem is available, check

    the problem history in the Action Center control panel. Process ID: fe4 Start Time:

    01cc0bea31db39b0 Termination Time: 94 Application Path: C:\Users\бнс\Desktop\OTL.exe

    Report

    Id: 1c087d6c-77de-11e0-b80c-001eec48393f

    Error - 6.5.2011 г. 08:43:26 | Computer Name = бнс-PC | Source = Application Hang | ID = 1002

    Description = The program OTL.exe version 3.2.22.3 stopped interacting with Windows

    and was closed. To see if more information about the problem is available, check

    the problem history in the Action Center control panel. Process ID: fd0 Start Time:

    01cc0beae91e0aa8 Termination Time: 31 Application Path: C:\Users\бнс\Desktop\OTL.exe

    Report

    Id: 69bae7de-77de-11e0-b80c-001eec48393f

    Error - 6.5.2011 г. 08:53:03 | Computer Name = бнс-PC | Source = Application Hang | ID = 1002

    Description = The program OTL.exe version 3.2.22.3 stopped interacting with Windows

    and was closed. To see if more information about the problem is available, check

    the problem history in the Action Center control panel. Process ID: bd8 Start Time:

    01cc0beb35d1c1dc Termination Time: 62 Application Path: C:\Users\бнс\Desktop\OTL.exe

    Report

    Id: c4b0f550-77df-11e0-b80c-001eec48393f

    Error - 6.5.2011 г. 09:06:13 | Computer Name = бнс-PC | Source = Application Hang | ID = 1002

    Description = The program OTL.exe version 3.2.22.3 stopped interacting with Windows

    and was closed. To see if more information about the problem is available, check

    the problem history in the Action Center control panel. Process ID: c04 Start Time:

    01cc0becf113e49b Termination Time: 62 Application Path: C:\Users\бнс\Desktop\OTL.exe

    Report

    Id: 9bbaecff-77e1-11e0-b704-001eec48393f

    [ System Events ]

    Error - 5.5.2011 г. 15:48:53 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7031

    Description = Услуга Diagnostic Policy Service беше прекъсната неочаквано. Това

    се е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното

    коригиращо действие: Рестартиране на услугата.

    Error - 5.5.2011 г. 15:48:53 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7031

    Description = Услуга Защитна стена на Windows беше прекъсната неочаквано. Това се

    е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното

    коригиращо действие: Рестартиране на услугата.

    Error - 5.5.2011 г. 15:50:56 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7032

    Description = Диспечерът за управление на услуги се опита да предприеме коригиращо

    действие (Рестартиране на услугата) след неочакваното прекъсване на услуга Base

    Filtering Engine, но това действие се оказа неуспешно поради следната грешка: %%1056

    Error - 5.5.2011 г. 15:55:25 | Computer Name = бнс-PC | Source = Disk | ID = 262155

    Description = The driver detected a controller error on \Device\Harddisk1\DR2.

    Error - 5.5.2011 г. 15:55:25 | Computer Name = бнс-PC | Source = Disk | ID = 262155

    Description = The driver detected a controller error on \Device\Harddisk1\DR2.

    Error - 5.5.2011 г. 15:55:26 | Computer Name = бнс-PC | Source = Disk | ID = 262155

    Description = The driver detected a controller error on \Device\Harddisk1\DR2.

    Error - 5.5.2011 г. 15:55:27 | Computer Name = бнс-PC | Source = Disk | ID = 262155

    Description = The driver detected a controller error on \Device\Harddisk1\DR2.

    Error - 6.5.2011 г. 07:03:29 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7000

    Description = Услуга srenum не може да бъде стартирана поради следната грешка: %%2

    Error - 6.5.2011 г. 07:03:29 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7000

    Description = Услуга svcoolk не може да бъде стартирана поради следната грешка:

    %%2

    Error - 6.5.2011 г. 08:54:52 | Computer Name = бнс-PC | Source = Service Control Manager | ID = 7000

    Description = Услуга srenum не може да бъде стартирана поради следната грешка: %%2

    < End of report >

    Стартирайте отново OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

    :otl
DRV - (GGSAFERDriver) -- File not found
IE - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..extensions.enabledItems: [email protected]:3.11.3.15590
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=CDS&o=16205&locale=en_US&apn_uid=B3B0287F-6821-4F0B-9372-1BEFBF88607D&apn_ptnrs=QR&apn_sauid=3378F2F6-DA93-41A9-95C2-76261C47FD13&apn_dtid=&q="
[2011.03.21 13:05:23 | 000,000,000 | ---D | M] (CrowdStar Gamebar) -- C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]
[2011.04.25 22:13:42 | 000,002,385 | ---- | M] () -- C:\Users\бнс\AppData\Roaming\Mozilla\Firefox\Profiles\x25f4lpk.default\searchplugins\askcom.xml
O2 - BHO: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-4294071207-530640845-1734815284-1000\..\Toolbar\WebBrowser: (CrowdStar Gamebar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [Local] File not found
O4 - HKLM..\Run: [Win7Service] File not found
O4 - HKLM..\Run: [wuaplo] File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
[2011.04.28 12:57:14 | 000,000,000 | -H-D | C] -- C:\$AVG
[2011.04.28 02:41:41 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG10
[2011.04.28 02:40:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2011.04.28 02:46:03 | 000,000,000 | ---D | M] -- C:\Users\бнс\AppData\Roaming\AVG10
:files
recycler /alldrives
ipconfig /flushdns /c
:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Users\бнс\Desktop\facebook-pic00320123561.exe" =-
"C:\Users\бнс\AppData\Roaming\wusolsl.exe" =-
"C:\Users\9974~1\AppData\Local\Temp\82185.exe" =-
"C:\Users\бнс\AppData\Roaming\local.exe" =-
"C:\Users\бнс\AppData\Roaming\bot10.exe" =- 
"C:\Users\9974~1\AppData\Local\Temp\52431.exe" =- 
:commands
[purity]
[clearallrestorepoints]
[emptytemp]
[emptyflash]
[Reboot]
    След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

    Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

    • Автор

    All processes killed

    ========== OTL ==========

    Service GGSAFERDriver stopped successfully!

    Service GGSAFERDriver deleted successfully!

    File File not found not found.

    Registry value HKEY_USERS\S-1-5-21-4294071207-530640845-1734815284-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.

    C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.

    Prefs.js: "Ask.com" removed from browser.search.defaultengine

    Prefs.js: "Ask.com" removed from browser.search.defaultenginename

    Prefs.js: "Ask.com" removed from browser.search.order.1

    Prefs.js: "Ask.com" removed from browser.search.selectedEngine

    Prefs.js: [email protected]:3.11.3.15590 removed from extensions.enabledItems

    Prefs.js: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=CDS&o=16205&locale=en_US&apn_uid=B3B0287F-6821-4F0B-9372-1BEFBF88607D&apn_ptnrs=QR&apn_sauid=3378F2F6-DA93-41A9-95C2-76261C47FD13&apn_dtid=&q=" removed from keyword.URL

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\searchplugins folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\logs folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\defaults\preferences folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\defaults folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\datastore folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome\temp\ff-config.Wed-16-Feb-2011-14-54-01-GMT folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome\temp\ff-config.Wed-05-May-2010-16-41-21-GMT folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome\temp\ff-config.Mon-21-Mar-2011-10-15-28-GMT folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome\temp\ff-config.Mon-21-Feb-2011-16-12-43-GMT folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome\temp\ff-config.Mon-14-Mar-2011-19-08-23-GMT folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome\temp folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome\skin folder moved successfully.

    C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome\content folder moved successfully.

    Folder move failed. C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected]\chrome scheduled to be moved on reboot.

    Folder move failed. C:\Users\бнс\AppData\Roaming\mozilla\Firefox\Profiles\x25f4lpk.default\extensions\[email protected] scheduled to be moved on reboot.

    C:\Users\бнс\AppData\Roaming\Mozilla\Firefox\Profiles\x25f4lpk.default\searchplugins\askcom.xml moved successfully.

    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.

    File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.

    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

    File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.

    Registry value HKEY_USERS\S-1-5-21-4294071207-530640845-1734815284-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.

    File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.

    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Local deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Win7Service deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\wuaplo deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

    C:\$AVG\$VAULT folder moved successfully.

    C:\$AVG folder moved successfully.

    C:\ProgramData\AVG10\scanlogs folder moved successfully.

    C:\ProgramData\AVG10\log\IDP\log folder moved successfully.

    C:\ProgramData\AVG10\log\IDP folder moved successfully.

    Folder move failed. C:\ProgramData\AVG10\log scheduled to be moved on reboot.

    C:\ProgramData\AVG10 folder moved successfully.

    C:\Program Files\AVG\AVG10\Notification folder moved successfully.

    C:\Program Files\AVG\AVG10 folder moved successfully.

    C:\Program Files\AVG folder moved successfully.

    C:\Users\бнс\AppData\Roaming\AVG10\cfgall folder moved successfully.

    C:\Users\бнс\AppData\Roaming\AVG10 folder moved successfully.

    ========== FILES ==========

    C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-2734 folder moved successfully.

    C:\RECYCLER folder moved successfully.

    recycler not found in D:\

    < ipconfig /flushdns /c >

    No captured output from command...

    C:\Users\бнс\Desktop\cmd.bat deleted successfully.

    ========== REGISTRY ==========

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\бнс\Desktop\facebook-pic00320123561.exe deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\бнс\AppData\Roaming\wusolsl.exe deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\9974~1\AppData\Local\Temp\82185.exe deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\бнс\AppData\Roaming\local.exe deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\бнс\AppData\Roaming\bot10.exe deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\9974~1\AppData\Local\Temp\52431.exe deleted successfully.

    ========== COMMANDS ==========

    Имаме още малко работа.

    Стъпка 1

    Стартирайте отново OTL и с Copy/ Paste под колонката Custom Scans/Fixes въведете скриптовия текст от текстовото поле по-долу, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

    :otl
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 51636
FF - prefs.js..network.proxy.type: 1
:files
recycler /alldrives
ipconfig /flushdns /c
:reg
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=-
"ProxyOverride"=-
"ProxyServer"=-
:commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

    Ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

    Стъпка 2

    Стартирайте отново DDS, както го направихте в първия си коментар и дайте лог от програмата.

    • Автор

    .

    DDS (Ver_11-03-05.01) - NTFSx86

    Run by Ў­б at 20:55:10,78 on ЇҐв 06.05.2011 Ј.

    Internet Explorer: 8.0.7600.16385

    Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1026.18.1014.492 [GMT 3:00]

    .

    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\wininit.exe

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\Explorer.EXE

    C:\Windows\system32\Dwm.exe

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

    C:\Program Files\Logitech\SetPointP\SetPoint.exe

    C:\Program Files\Adobe\Reader 10.0\Reader\reader_sl.exe

    C:\Program Files\uTorrent\uTorrent.exe

    C:\Program Files\DAEMON Tools Lite\DTLite.exe

    C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

    C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

    C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

    C:\Windows\system32\SearchIndexer.exe

    C:\Windows\system32\SearchProtocolHost.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Users\бнс\Desktop\dds.scr

    C:\Windows\system32\conhost.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://fullarticles.net

    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office14\GROOVEEX.DLL

    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL

    uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

    uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun

    uRun: [Google Update] "c:\users\бнс\appdata\local\google\update\GoogleUpdate.exe" /c

    mRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices

    mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

    mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe

    mRun: [indexSearch] c:\program files\scansoft\paperport\IndexSearch.exe

    mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming

    mRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033

    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"

    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

    mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

    mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

    mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

    mExplorerRun: [wuaplo] c:\users\бнс\appdata\roaming\wusolsl.exe

    StartupFolder: c:\users\9974~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office14\ONENOTEM.EXE

    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe

    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

    mPolicies-system: EnableLUA = 0 (0x0)

    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

    Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office14\GROOVEEX.DLL

    mASetup: {98BB6A2D-FACA-FECF-AA1C-95A9BCFCBDDA} - c:\users\бнс\appdata\roaming\wusolsl.exe

    mASetup: {DA59C2AE-F5AF-AA1F-AA3B-398FC0BAE8F2} - c:\users\бнс\appdata\roaming\local.exe

    uASetup: {98BB6A2D-FACA-FECF-AA1C-95A9BCFCBDDA} - c:\users\бнс\appdata\roaming\wusolsl.exe

    uASetup: {DA59C2AE-F5AF-AA1F-AA3B-398FC0BAE8F2} - c:\users\бнс\appdata\roaming\local.exe

    .

    ============= SERVICES / DRIVERS ===============

    .

    R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]

    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]

    S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-1-21 30963576]

    S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

    S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

    S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]

    S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:\windows\system32\wat\WatAdminSvc.exe [2011-2-19 1343400]

    .

    =============== Created Last 30 ================

    .

    2011-05-06 13:57:59 -------- d-----w- c:\users\9974~1\appdata\roaming\Malwarebytes

    2011-05-06 13:57:53 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2011-05-06 13:57:53 -------- d-----w- c:\progra~2\Malwarebytes

    2011-05-06 13:57:50 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

    2011-05-06 13:57:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2011-05-06 13:40:36 -------- d-----w- C:\_OTM

    2011-05-06 12:39:13 -------- d-----w- C:\_OTL

    2011-04-30 20:19:35 139 ----a-w- c:\users\9974~1\appdata\roaming\microsoft\gb_96689.bat

    2011-04-29 17:55:06 151 ----a-w- c:\users\9974~1\appdata\roaming\microsoft\gb_76087334.bat

    2011-04-27 23:45:26 -------- d--h--w- c:\progra~2\Common Files

    2011-04-27 23:37:02 -------- d-----w- c:\progra~2\MFAData

    2011-04-27 22:59:38 -------- d-----w- c:\users\9974~1\appdata\roaming\updates

    2011-04-25 19:18:07 -------- d-----w- c:\users\9974~1\appdata\local\Google

    2011-04-24 18:59:37 -------- d-----w- c:\users\9974~1\appdata\roaming\mIRC

    2011-04-22 20:04:34 -------- d-----w- c:\users\9974~1\appdata\roaming\Darer

    2011-04-22 20:03:07 -------- d-----w- c:\program files\Darer

    2011-04-15 18:01:42 -------- d-----w- c:\users\9974~1\appdata\local\Apps

    2011-04-15 18:01:41 -------- d-----w- c:\users\9974~1\appdata\local\Deployment

    .

    ==================== Find3M ====================

    .

    2011-02-19 05:33:11 802304 ----a-w- c:\windows\system32\FntCache.dll

    2011-02-19 05:32:48 1074176 ----a-w- c:\windows\system32\DWrite.dll

    2011-02-19 05:32:35 739840 ----a-w- c:\windows\system32\d2d1.dll

    2011-02-16 15:16:12 2829 ----a-w- c:\windows\War3Unin.pif

    2011-02-16 15:16:12 139264 ----a-w- c:\windows\War3Unin.exe

    .

    ============= FINISH: 20:56:06,43 ===============

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_11-03-05.01)

    .

    Microsoft Windows 7 Ultimate

    Boot Device: \Device\HarddiskVolume1

    Install Date: 25.2.2010 г. 22:28:08

    System Uptime: 6.5.2011 г. 20:53:46 (0 hours ago)

    .

    Motherboard: Acer | | Acadia

    Processor: Intel® Celeron® CPU 560 @ 2.13GHz | uPGA-478 | 2128/133mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 51 GiB total, 33,886 GiB free.

    D: is FIXED (NTFS) - 61 GiB total, 47,684 GiB free.

    E: is CDROM ()

    F: is CDROM ()

    .

    ==== Disabled Device Manager Items =============

    .

    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

    Description: Atheros AR5007EG Wireless Network Adapter

    Device ID: PCI\VEN_168C&DEV_001C&SUBSYS_04281468&REV_01\4&512B05C&0&00E3

    Manufacturer: Atheros Communications Inc.

    Name: Atheros AR5007EG Wireless Network Adapter

    PNP Device ID: PCI\VEN_168C&DEV_001C&SUBSYS_04281468&REV_01\4&512B05C&0&00E3

    Service: athr

    .

    ==== System Restore Points ===================

    .

    RP71: 6.5.2011 г. 00:41:09 - Removed AVG 2011

    RP72: 6.5.2011 г. 00:48:08 - Removed AVG 2011

    RP73: 6.5.2011 г. 00:56:51 - Removed AVG 2011

    RP75: 6.5.2011 г. 01:09:13 - Windows Defender Checkpoint

    .

    ==== Installed Programs ======================

    .

    µTorrent

    7-Zip 9.20

    Adobe AIR

    Adobe Community Help

    Adobe Flash Player 10 ActiveX

    Adobe Flash Player 10 Plugin

    Adobe Media Player

    Adobe Photoshop CS5

    Adobe Reader X (10.0.1)

    Ask Toolbar

    Brother DCP-7010

    Diablo II - Eastern Sun 3.00 Full

    eReg

    Garena 2010

    Google Chrome

    Logitech SetPoint 6.0

    Malwarebytes' Anti-Malware

    McAfee Security Scan Plus

    Microsoft .NET Framework 4 Client Profile

    Microsoft Office Access MUI (English) 2010

    Microsoft Office Access Setup Metadata MUI (English) 2010

    Microsoft Office Excel MUI (English) 2010

    Microsoft Office Groove MUI (English) 2010

    Microsoft Office InfoPath MUI (English) 2010

    Microsoft Office OneNote MUI (English) 2010

    Microsoft Office Outlook MUI (English) 2010

    Microsoft Office PowerPoint MUI (English) 2010

    Microsoft Office Professional Plus 2010

    Microsoft Office Proof (English) 2010

    Microsoft Office Proof (French) 2010

    Microsoft Office Proof (Spanish) 2010

    Microsoft Office Proofing (English) 2010

    Microsoft Office Publisher MUI (English) 2010

    Microsoft Office Shared MUI (English) 2010

    Microsoft Office Shared Setup Metadata MUI (English) 2010

    Microsoft Office Word MUI (English) 2010

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

    Microsoft_VC80_ATL_x86

    Microsoft_VC80_CRT_x86

    Microsoft_VC80_MFC_x86

    Microsoft_VC80_MFCLOC_x86

    Microsoft_VC90_ATL_x86

    Microsoft_VC90_CRT_x86

    Microsoft_VC90_MFC_x86

    One

    PaperPort

    PDF Settings CS5

    Skype Toolbars

    Skype™ 4.2

    StoreHouse LITE 2.0.2-16

    VLC media player 1.0.5

    Warcraft III

    Warcraft III: All Products

    Winamp

    Winamp Detector Plug-in

    Windows Media Player Firefox Plugin

    .

    ==== Event Viewer Messages From Past Week ========

    .

    6.5.2011 г. 17:48:45, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга ShellHWDetection.

    6.5.2011 г. 15:54:52, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    6.5.2011 г. 14:03:29, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    6.5.2011 г. 14:03:29, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    5.5.2011 г. 22:55:27, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.

    5.5.2011 г. 22:55:26, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.

    5.5.2011 г. 22:55:25, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.

    5.5.2011 г. 22:55:25, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.

    5.5.2011 г. 22:50:56, Error: Service Control Manager [7032] - Диспечерът за управление на услуги се опита да предприеме коригиращо действие (Рестартиране на услугата) след неочакваното прекъсване на услуга Base Filtering Engine, но това действие се оказа неуспешно поради следната грешка: Вече се изпълнява екземпляр на услугата.

    5.5.2011 г. 22:48:53, Error: Service Control Manager [7031] - Услуга Diagnostic Policy Service беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата.

    5.5.2011 г. 22:48:53, Error: Service Control Manager [7031] - Услуга Base Filtering Engine беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата.

    5.5.2011 г. 22:48:53, Error: Service Control Manager [7031] - Услуга Защитна стена на Windows беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 120000 милисекунди ще бъде предприето следното коригиращо действие: Рестартиране на услугата.

    5.5.2011 г. 15:54:32, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    5.5.2011 г. 15:54:32, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Достъпът е отказан.

    5.5.2011 г. 15:32:48, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    5.5.2011 г. 15:32:47, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Достъпът е отказан.

    5.5.2011 г. 15:25:42, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    5.5.2011 г. 15:25:41, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Достъпът е отказан.

    5.5.2011 г. 15:11:36, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    5.5.2011 г. 15:11:35, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Достъпът е отказан.

    5.5.2011 г. 15:10:00, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга avgwd.

    5.5.2011 г. 04:48:18, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга Wlansvc.

    4.5.2011 г. 21:07:33, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    4.5.2011 г. 21:07:33, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Достъпът е отказан.

    30.4.2011 г. 23:20:12, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга BITS.

    30.4.2011 г. 23:20:12, Error: Service Control Manager [7000] - Услуга Background Intelligent Transfer Service не може да бъде стартирана поради следната грешка: Услугата не отговори навреме на искане за стартиране или управление.

    30.4.2011 г. 23:20:12, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

    30.4.2011 г. 23:19:42, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга iphlpsvc.

    30.4.2011 г. 23:18:51, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    30.4.2011 г. 23:18:44, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    30.4.2011 г. 23:18:35, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - Компютърът е рестартиран от проверка за грешки. Проверката е: 0x000000f4 (0x00000003, 0xac2d8930, 0xac2d8a9c, 0x82c636a0). Разтоварването е записано в: C:\Windows\MEMORY.DMP. ИД на доклада: 043011-32073-01.

    30.4.2011 г. 23:06:10, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    30.4.2011 г. 23:06:10, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    30.4.2011 г. 23:06:09, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - Компютърът е рестартиран от проверка за грешки. Проверката е: 0x000000f4 (0x00000003, 0x866407d0, 0x8664093c, 0x82c726a0). Разтоварването е записано в: C:\Windows\MEMORY.DMP. ИД на доклада: 043011-50778-01.

    30.4.2011 г. 22:57:36, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

    30.4.2011 г. 22:57:35, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

    30.4.2011 г. 22:57:35, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

    30.4.2011 г. 22:57:34, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

    30.4.2011 г. 22:57:34, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

    30.4.2011 г. 22:56:04, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004

    30.4.2011 г. 21:28:45, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга Wlansvc.

    3.5.2011 г. 06:37:19, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга ShellHWDetection.

    3.5.2011 г. 00:35:22, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга Netman.

    29.4.2011 г. 20:52:19, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга ShellHWDetection.

    29.4.2011 г. 05:48:47, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга iphlpsvc.

    29.4.2011 г. 05:48:05, Error: Service Control Manager [7022] - Услуга AVGIDSAgent увисна при стартиране.

    29.4.2011 г. 05:48:05, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга ShellHWDetection.

    2.5.2011 г. 05:45:24, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга ShellHWDetection.

    1.5.2011 г. 23:44:49, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - Компютърът е рестартиран от проверка за грешки. Проверката е: 0x000000f4 (0x00000003, 0x86802858, 0x868029c4, 0x82c7c6a0). Разтоварването е записано в: C:\Windows\MEMORY.DMP. ИД на доклада: 050111-51308-01.

    1.5.2011 г. 23:44:48, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    1.5.2011 г. 23:44:47, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    1.5.2011 г. 23:39:00, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - Компютърът е рестартиран от проверка за грешки. Проверката е: 0x000000f4 (0x00000003, 0x866a5b38, 0x866a5ca4, 0x82c656a0). Разтоварването е записано в: C:\Windows\MEMORY.DMP. ИД на доклада: 050111-54631-01.

    1.5.2011 г. 23:38:46, Error: Service Control Manager [7000] - Услуга svcoolk не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    1.5.2011 г. 23:38:44, Error: Service Control Manager [7000] - Услуга srenum не може да бъде стартирана поради следната грешка: Системата не може да намери указания файл.

    1.5.2011 г. 19:27:31, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга ShellHWDetection.

    1.5.2011 г. 19:27:31, Error: Service Control Manager [7011] - Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга lmhosts.

    .

    ==== End Of File ===========================

    •
    • Харесване 1

    Съжалявам, но от лога на DDS се виждат още инфекции. Затова няма как да минем без по-сериозен инструмент.

    Затова изтеглете ComboFix от: тук

    ВАЖНО: Запазете ComboFix.exe на вашия десктоп!

    • Изключете вашата антивирусна и антишпионска програма. Обикновено това става чрез натискане на десния бутон на мишката върху иконата на програма в системния трей.

      Забележка: Ако не можете я спрете или не сте сигурни коя програма да изключите, моля прегледайте информацията от този линк: How to Disable your Security Programs

    • Стартирайте Combofix.exe и следвайте инструкциите.

    Забележка:

    • Моля, не движете мишката, докато ComboFix работи. Това може да наруши процеса на работа.
    • ComboFix ще нулира всички настройки на Internet Explorer (IE), включително да направи IE браузър по подразбиране.
    • ComboFix ще изключи autorun функцията на всички CD, Floppy и USB устройства, за да помогне при премахването на зловредния софтуер и защити системата от бъдещи вируси/заплахи, които поразяват посредством autorun. Ако това е проблем за вас - моля, уведомете ме.
    • ComboFix ще изключи вашата интернет връзка. Интернет връзката ще се възстанови автоматично, преди ComboFix да завърши процеса на работа. При проблем, той също ще изключи интернет връзката. За да възстановите интернет връзката си, рестартирайте компютъра си.
    • В случай на проблем с ComboFix, той може да създаде лог файл. Моля, включете съдържанието на C:\BUG.txt в следващия Ви коментар в тази тема.

    Работата на ComboFix може да отнеме до 20-30 минути. Затова имайте имайте търпение. Когато процесът приключи успешно, ComboFix ще създаде лог файл. Моля, копирайте съдържанието на C:\ComboFix.txt и го поставете в следващия си коментар в тази тема.

    •
    • Харесване 2
    • Автор

    ComboFix 11-05-05.04 - бнс 05.2011 г. 21:49:10.1.1 - x86

    Microsoft Windows 7 Ultimate 6.1.7600.0.1251.359.1026.18.1014.454 [GMT 3:00]

    Running from: c:\users\бнс\Desktop\ComboFix.exe

    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\program files\Windows NT\DATA

    c:\users\бнс\AppData\Roaming\updates

    c:\windows\ntdll.dl

    c:\windows\system32\spool\prtprocs\w32x86\ppbiPr.dll

    D:\install.exe

    .

    .

    ((((((((((((((((((((((((( Files Created from 2011-04-06 to 2011-05-06 )))))))))))))))))))))))))))))))

    .

    .

    2011-05-06 18:54 . 2011-05-06 18:54 -------- d-----w- c:\users\бнс\AppData\Local\temp

    2011-05-06 18:54 . 2011-05-06 18:54 -------- d-----w- c:\users\Default\AppData\Local\temp

    2011-05-06 13:57 . 2011-05-06 13:57 -------- d-----w- c:\users\бнс\AppData\Roaming\Malwarebytes

    2011-05-06 13:57 . 2011-05-06 13:57 -------- d-----w- c:\programdata\Malwarebytes

    2011-05-06 13:57 . 2010-12-20 15:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2011-05-06 13:57 . 2011-05-06 13:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2011-05-06 13:57 . 2010-12-20 15:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

    2011-05-06 13:40 . 2011-05-06 13:40 -------- d-----w- C:\_OTM

    2011-05-06 12:39 . 2011-05-06 12:39 -------- d-----w- C:\_OTL

    2011-05-05 20:14 . 2011-05-05 20:15 -------- d-----w- c:\program files\7-Zip

    2011-04-30 20:19 . 2011-04-30 20:19 139 ----a-w- c:\users\бнс\AppData\Roaming\Microsoft\gb_96689.bat

    2011-04-29 17:55 . 2011-04-29 17:55 151 ----a-w- c:\users\бнс\AppData\Roaming\Microsoft\gb_76087334.bat

    2011-04-27 23:45 . 2011-04-27 23:45 -------- d--h--w- c:\programdata\Common Files

    2011-04-27 23:37 . 2011-05-05 22:01 -------- d-----w- c:\programdata\MFAData

    2011-04-25 19:18 . 2011-05-01 19:06 -------- d-----w- c:\users\бнс\AppData\Local\Google

    2011-04-24 18:59 . 2011-04-25 20:10 -------- d-----w- c:\users\бнс\AppData\Roaming\mIRC

    2011-04-22 20:04 . 2011-04-22 20:12 -------- d-----w- c:\users\бнс\AppData\Roaming\Darer

    2011-04-22 20:03 . 2011-04-22 20:12 -------- d-----w- c:\program files\Darer

    2011-04-15 18:01 . 2011-04-15 18:01 -------- d-----w- c:\users\бнс\AppData\Local\Apps

    2011-04-15 18:01 . 2011-05-01 19:04 -------- d-----w- c:\users\бнс\AppData\Local\Deployment

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2011-03-12 10:52 . 2010-03-25 12:05 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys

    2011-02-19 05:33 . 2011-03-09 10:02 802304 ----a-w- c:\windows\system32\FntCache.dll

    2011-02-19 05:32 . 2011-03-09 10:02 1074176 ----a-w- c:\windows\system32\DWrite.dll

    2011-02-19 05:32 . 2011-03-09 10:02 739840 ----a-w- c:\windows\system32\d2d1.dll

    2011-02-16 15:16 . 2011-02-16 15:12 2829 ----a-w- c:\windows\War3Unin.pif

    2011-02-16 15:16 . 2011-02-16 15:12 139264 ----a-w- c:\windows\War3Unin.exe

    2011-02-16 15:02 . 2011-02-16 15:02 223128 ----a-w- c:\windows\system32\drivers\dtscsi.sys

    2011-02-11 06:54 . 2011-03-22 11:08 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{585E4400-858C-4B66-96DF-3AEFBD258DE1}\mpengine.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-25 319280]

    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520]

    "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]

    "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]

    "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]

    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]

    "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-11-08 128920]

    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-29 500208]

    "SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

    "AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

    .

    c:\users\Ў­б\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

    OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-1-21 226176]

    .

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 0 (0x0)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableLUA"= 0 (0x0)

    "EnableUIADesktopToggle"= 0 (0x0)

    "PromptOnSecureDesktop"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

    2010-01-29 21:17 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

    "aux"=wdmaud.drv

    .

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

    R3 GGSAFERDriver;GGSAFER Driver;c:\program files\Garena\safedrv.sys [x]

    R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]

    R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]

    R3 ndisrd;WinpkFilter Service;c:\windows\system32\DRIVERS\ndisrd.sys [x]

    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

    R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

    R3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-18 1343400]

    S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-02-27 691696]

    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

    .

    .

    Contents of the 'Scheduled Tasks' folder

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = hxxp://fullarticles.net

    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

    .

    - - - - ORPHANS REMOVED - - - -

    .

    HKLM_ActiveSetup-{98BB6A2D-FACA-FECF-AA1C-95A9BCFCBDDA} - c:\users\бнс\AppData\Roaming\wusolsl.exe

    HKLM_ActiveSetup-{DA59C2AE-F5AF-AA1F-AA3B-398FC0BAE8F2} - c:\users\бнс\AppData\Roaming\local.exe

    HKCU_ActiveSetup-{98BB6A2D-FACA-FECF-AA1C-95A9BCFCBDDA} - c:\users\бнс\AppData\Roaming\wusolsl.exe

    HKCU_ActiveSetup-{DA59C2AE-F5AF-AA1F-AA3B-398FC0BAE8F2} - c:\users\бнс\AppData\Roaming\local.exe

    .

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    "MSCurrentCountry"=dword:000000b5

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Completion time: 2011-05-06 21:57:12

    ComboFix-quarantined-files.txt 2011-05-06 18:57

    .

    Pre-Run: 36 160 004 096 bytes free

    Post-Run: 35 702 444 032 bytes free

    .

    - - End Of File - - C079F09FCA8512101F4874B9228682D9

    •
    • Харесване 2

    Сега отворете Notepad и с copy/paste въведете следната информация:

    Driver::
ndisrd

File::
c:\users\бнс\AppData\Roaming\Microsoft\gb_96689.bat
c:\users\бнс\AppData\Roaming\Microsoft\gb_76087334.bat
c:\windows\system32\DRIVERS\ndisrd.sys 

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

KillAll::

    Запазете файла с име CFScript на десктопа, провлачете и го пуснете в Combofix, както е показано на снимката:

    Публикувано изображение

    Забележка: По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !

    Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си коментар.

    P.S. След като ComboFix приключи работата си вижте как се държи Windows. Има ли някакви проблеми с натоварване на процесора, както беше в началото?

    •
    • Харесване 2
    • Автор

    Така ... лаптопа се държи по добре вече мога да влизам в интернет да пускам и други програми.При последната операция след завършване на работата на ComboFix се появи лог прозореца,аз го копирах но не можех да вляза в интернет нито да отворя текстови файл на който да го запиша.Впрочем нито едно екзе не се отваряше и аз рестартирах компютъра,но след това не знам къде се е сейвъло за да го постна.

    •
    • Харесване 1

    Много добре. Сега аз искам една услуга от вас. Направете ZIP архив на следните папки:

    C:\_OTM\MovedFiles

    C:\Qoobox

    След като направите двата архива ги качете последователно на rapidshare.com и дайте линк, за да ги изтеглим.

    •
    • Харесване 1
    • Автор

    В момента качвам C:\_OTM\MovedFiles но е 250mb качва се с 20kb така че няма да стане скоро.Даде грешка при създаване на рара на C:\Qoobox грешката беше на файл с име C:\Qoobox\BlackEnv\

    •
    • Харесване 2

    Регистрирайте се или влезете в профила си за да коментирате
    Назад

    Разглеждащи това в момента 0

    • Няма регистрирани потребители разглеждащи тази страница.

    Дарение

    • Подкрепи съществуването на форума - направи дарение
      32%
      Дарени 315 € от нужните 1 000 €

    Бюлетин

    Получавайте известие, когато има важна промяна или новина свързана с форума.
    Абонирайте се

    Профил

    Навигация

    Търсене

    Търсене

    Конфигуриране на push известия в браузъра
    Chrome (Android)
    1. Докоснете иконата на катинар до адресната лента.
    2. Докоснете Разрешения → Известия.
    3. Променете предпочитанията си.
    Chrome (Desktop)
    1. Кликнете върху иконата на катинар в адресната лента.
    2. Изберете Настройки на сайта.
    3. Намерете Известия и коригирайте предпочитанията си.